CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- apache inlongApache InLong: Jdbc Connection Security Bypass9.8 Critical
- google androidIn run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to...7.8 High
- apache linkis, apache software foundation linkis (incubating) +1 moreApache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability8.8 High
- hutoolDromara Hutool Deserialization of Untrusted Data vulnerability9.8 Critical
- codeinwp revive old posts, revive old posts +1 moreRevive Old Posts – Social Media Auto Post and Scheduling Plugin < 9.0.11 - PHP Object Injection7.2 High
- schneider electric data center expertA CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be...7.1 High
- vmware vrealize log insightvRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor...7.5 High
- sumo google analyticator, unknown analyticator +1 moreGoogle Analyticator < 6.5.6 - Admin+ PHP Object Injection7.2 High
- sumo google analyticator, unknown analyticator +1 moreGoogle Analyticator < 6.5.6 - Admin+ PHP Object Injection7.2 High
- opentext extended ecmAn issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common...8.8 High
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...7.5 High
- abhilash1985 predictappabhilash1985 PredictApp Cookie new_framework_defaults_7_0.rb deserialization6.3 Medium
- tikiTiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object...8.8 High
- datax-web project datax-webThe RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by...9.8 Critical
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied...9.8 Critical
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability7.8 High
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 23 +2 more +4 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 11 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- microsoft sharepoint server, sharepoint enterprise server 2013 service pack 1, sharepoint enterprise server 2016 +4 more +6 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft .net, fedoraproject fedora, microsoft .net 6.0 +2 more +4 more.NET Denial of Service Vulnerability7.5 High
- spitfire project spitfireSpitfire CMS 1.0.475 is vulnerable to PHP Object Injection.8.8 High
- kadencewp starter templates, unknown starter templates by kadence wp +1 moreStarter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection8.8 High
- bravenewcode wptouchWPtouch < 4.3.45 - Admin+ PHP Object Injection8.8 High
- northern beaches websites wp custom admin interface, wp custom admin interface project custom admin interface +1 moreWP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection7.2 High
- hyland nuxeoRegular expression Denial of Service in MooTools5.4 Medium
- apache dubboRegular expression Denial of Service in MooTools9.8 Critical
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation8.8 High
- hiroaki miyashita custom field templateCustom Field Template < 2.5.8 - Admin+ PHP Object Injection7.2 High
- unknown white label cmsWhite Label CMS < 2.5 - Admin+ PHP Object Injection7.2 High
- x-stream xstreamXStream Denial of Service via stack overflow8.2 High
- trumani stop spammers, unknown stop spammers security | block spam users, comments, forms +1 moreStop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection9.8 Critical
- huawei emui, harmonyos +1 moreThe system tool has inconsistent serialization and deserialization. Successful exploitation of...7.5 High
- ruoyiDeserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary...9.8 Critical
- replicator project replicatorreplicator vulnerable to Deserialization of Untrusted Data9.8 Critical
- boxystudio cooked, gora tech llc cooked pro +1 moreCooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection9.8 Critical
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection8.8 High
- hope-boot project hope-boothope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).9.8 Critical
- skycaijiSkycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin...9.8 Critical
- apache tapestryApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input9.8 Critical
- snakeyamlRemote Code execution in SnakeYAML8.3 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data8.8 High
- themehigh checkout field editor (checkout manager) for woocommerce, checkout field editor for woocommerce +1 moreCheckout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object Injection7.2 High
- 4ra1n super-xray, super xray project xray +1 moreDeserialization Vulnerability by yaml config input in super-xray7.3 High
- airbnb opticaRemote Code Execution in Optica10.0 Critical
- yiiframework yiiyiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input8.1 High
- muffingroup bethemeBetheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- librenms, librenms librenms/librenms +1 moreDeserialization of Untrusted Data in librenms/librenms9.0 Critical
- muffingroup betheme, betheme (wordpress theme) +1 moreWordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability6.3 Medium
- apache sshd, apache software foundation mina sshd +1 moreApache MINA SSHD: Java unsafe deserialization vulnerability9.8 Critical
- apache soapApache SOAP allows unauthenticated users to potentially invoke arbitrary code9.8 Critical
- Show moreLoading…