CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- ivanti avalancheThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- ivanti avalancheThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- ivanti avalancheThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- ivanti avalancheThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- aveva edgeThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...7.8 High
- opc labs quickopcThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...7.8 High
- keysight technologies n6854a geolocation server, keysight n6854a firmware +1 moreN6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which...7.8 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a...7.8 High
- delta electronics infrasuite device masterCVE-2023-11398.8 High
- delta electronics infrasuite device masterCVE-2023-11339.8 Critical
- apache inlongApache InLong: JDBC Deserialization Vulnerability in InLong8.8 High
- huawei emui, harmonyos +1 moreThe pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of...7.5 High
- huawei emui, harmonyos +1 moreThe InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful...7.8 High
- adobe coldfusionAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution9.8 Critical
- leadgenerated lead generatedThe Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure...9.8 Critical
- schneider electric igss data server(igssdataserver.exe), schneider-electric custom reports, igss dashboard +3 more +5 moreA CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that...7.8 High
- knplabs snappySnappy vulnerable to PHAR deserialization, allowing remote code execution9.8 Critical
- apache log4jApache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender7.5 High
- apache dubboApache Dubbo Deserialization Vulnerability Gadgets Bypass5.0 Medium
- yf-exam project yf-examCleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code...9.8 Critical
- spip, debian linux +1 moreSPIP before 4.2.1 allows Remote Code Execution via form values in the public area because...9.8 Critical
- litedbLiteDB contains Deserialization of Untrusted Data7.3 High
- themekraft buddyformsThe BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated...9.8 Critical
- hewlett packard enterprise (hpe) hpe serviceguard for linux, hpe serviceguard for linux +1 moreUnauthenticated Java deserialization vulnerability in Serviceguard Manager9.8 Critical
- seacmsSeaCMS Picture Management config.ftp.php deserialization4.7 Medium
- mongodb inc .net/c# driver, mongodb c\# driver +1 moreDeserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution6.6 Medium
- hastech shoplentorShopLentor < 2.5.4 - PHP Object Injection9.8 Critical
- jd-gui project jd-guiJD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.6.6 Medium
- ibm aspera faspexIBM Aspera Faspex code execution9.8 Critical
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- microsoft sql server, sql server 2012 for x64-based systems service pack 4 (qfe), sql server 2012 service pack 4 (qfe) +9 more +11 moreMicrosoft SQL Server Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 11 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability7.2 High
- microsoft azure data box gateway, azure stack edge +1 moreAzure Data Box Gateway Remote Code Execution Vulnerability6.5 Medium
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 23 +2 more +4 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- microsoft sql server integration services for visual studio 2019, sql server integration services for visual studio 2022, sql server 2019 integration services +1 more +3 moreMicrosoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability7.3 High
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 23 +2 more +4 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 23 +2 more +4 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- dompdf, dompdf dompdf/dompdf +1 morePHAR Deserialization in dompdf/dompdf9.8 Critical
- datahub-project datahubDeserialization of untrusted data in DataHub7.5 High
- redhat drools, red hat build of apache camel for spring boot, build of quarkus +16 more +18 moreDrools: unsafe data deserialization in streamutils8.1 High
- orangelab imagemagick engineImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization8.8 High
- thinkphpDeserialization of Untrusted Data in thinkphp9.8 Critical
- apache kafka connect, apache software foundation kafka connect api +1 moreApache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect8.8 High
- realmag777 husky, pluginus husky - products filter professional for woocommerce +1 moreWOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection7.2 High
- fortra goanywhere mft, goanywhere managed file transfer +1 moreFortra GoAnywhere MFT License Response Servlet Command Injection7.2 High
- vbulletinvBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code...9.8 Critical
- Show moreLoading…