CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- crmebZhong Bang CRMEB Image Upload app_auth deserialization6.3 Medium
- fasterxml jackson-databindAn issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of...4.7 Medium
- apache nifiApache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components6.5 Medium
- rails kredis jsonKredis JSON Possible Deserialization of Untrusted Data Vulnerability5.3 Medium
- mimsoftware mim concurrent license server, mim local concurrent license server +1 moreAn issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed...8.8 High
- vmware vrealize network insightAria Operations for Networks contains an authenticated deserialization vulnerability. A malicious...8.8 High
- f1logic newsletter managerNewsletter Manager <= 1.5.1 - Insecure Deserialization9.8 Critical
- etoilewebdesign ultimate reviewsUltimate Reviews < 2.1.33 - PHP Object Injection9.8 Critical
- ninjateam gdpr ccpa compliance & cookie consent banner, gpdr ccpa compliance support +1 moreGDPR CCPA Compliance Support <= 2.3 - PHP Object Injection9.8 Critical
- xxl-rpc project xxl-rpcxxl-rpc deserialization vulnerability9.8 Critical
- marvalglobal msmMarval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote...8.8 High
- gnome glib, fedora extra packages for enterprise linux, fedora +9 more +11 moreGvariant deserialisation does not match spec for non-normal data5.5 Medium
- glib, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreA flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of...4.7 Medium
- dataeaseDataEase data source has deserialization vulnerability9.8 Critical
- google androidIn multiple functions of sta_iface.cpp, there is a possible out of bounds read due to unsafe...6.7 Medium
- google androidIn initiateVenueUrlAnqpQueryInternal of sta_iface.cpp, there is a possible out of bounds read due...4.4 Medium
- google androidIn startWpsPinDisplayInternal of sta_iface.cpp, there is a possible out of bounds read due to...5.5 Medium
- google androidIn run of multiple files, there is a possible escalation of privilege due to unsafe...7.8 High
- themeisle otterOtter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization8.8 High
- granth go pricing - wordpress responsive pricing tables, granthweb go pricing +1 moreGo Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- hitachi vantara pentaho, vantara pentaho business analytics server, hitachi vantara pentaho business analytics server +2 moreHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data8.0 High
- sitecore experience platformDeserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote...9.8 Critical
- apache inlongApache InLong: JDBC URL bypassing by adding blanks7.5 High
- ibm infosphere information serverIBM InfoSphere Information Server code execution8.8 High
- glazedlists glazed listsglazedlists XML Deserialization vulnerability9.8 Critical
- ad inserter inserter, unknown ad inserter +1 moreAd Inserter < 2.7.27 - Admin+ PHP Object Injection7.2 High
- vmware cloud foundation, vrealize operations +1 moreVMware Aria Operations contains a deserialization vulnerability. A malicious actor with...7.2 High
- siemens siveillance video 2020 r2, siveillance video 2020 r3, siveillance video 2021 r1 +6 more +8 moreA vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2...9.9 Critical
- siemens siveillance video 2020 r2, siveillance video 2020 r3, siveillance video 2021 r1 +6 more +8 moreA vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2...9.9 Critical
- unknown customizer export/import, fastlinemedia customizer export\/import +1 moreCustomizer Export/Import < 0.9.6 - Admin+ PHP Object Injection7.2 High
- quantumcloud ai chatbot, wpbot +1 moreChatBot < 4.4.7 - Unauthenticated PHP Object Injection9.8 Critical
- advancedcustomfields advanced custom fields, unknown advanced custom fields (acf), advanced custom fields (acf) pro +2 moreAdvanced Custom Fields - Contributor+ PHP Object Injection8.8 High
- seopressSEOPress < 6.5.0.3 - Admin+ PHP Object Injection7.2 High
- keysight n8844a, n8844a data analytics web service +1 moreCVE-2023-19679.8 Critical
- aenrich a+hrd, a\+hrd +1 moreaEnrich a+HRD - Deserialization of Untrusted Data9.8 Critical
- aenrich a+hrd, a\+hrd +1 moreaEnrich a+HRD - Deserialization of Untrusted Data9.8 Critical
- 3ds delmia aprisoUnsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 20228.5 High
- vmware aria operations for logs, cloud foundation +1 moreVMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated,...9.8 Critical
- laravelA deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to...9.8 Critical
- datagearDataGear JDBC Server deserialization5.3 Medium
- ge toolboxstToolboxST Deserialization of Untrusted Configuration Data2.9 Low
- joomunited wp meta seoWP Meta SEO < 4.5.5 - Author+ PHAR Deserialization8.8 High
- apache linkisApache Linkis DatasourceManager module has a deserialization command execution9.8 Critical
- apache linkisApache Linkis JDBC EngineCon has a deserialization command execution9.8 Critical
- adobe livecycle es4** UNSUPPORTED WHEN ASSIGNED ** A Java insecure deserialization vulnerability in Adobe LiveCycle...9.8 Critical
- glpi-project orderOrder GLPI plugin vulnerable to remote code execution from authenticated user8.8 High
- cisco secure network analytics, stealthwatch management console 2200 firmware +1 moreCisco Secure Network Analytics Remote Code Execution Vulnerability8.8 High
- zend frameworkAn issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary...9.8 Critical
- payara serverPayara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed9.8 Critical
- foxit pdf editor, pdf reader +1 moreThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...7.8 High
- Show moreLoading…