CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- knplabs snappyUnsafe deserialization in knplabs/knp-snappy9.8 Critical
- azul zulu, software ag webmethods onedata, softwareag webmethods +2 moreSoftware AG webMethods OneData Deserialization Vulnerability9.8 Critical
- apache supersetApache Superset: Metadata db write access can lead to remote code execution6.6 Medium
- cacti, fedoraproject fedora +1 moreInsecure Deserialization in Cacti4.3 Medium
- dell alienware command center, alienware command center (awcc) +1 moreDell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of...7.8 High
- google androidIn checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to...7.8 High
- splunk, splunk enterprise, cloud +1 more +3 moreRemote Code Execution via Serialized Session Payload8.8 High
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCE8.8 High
- dream0x01 weblogic-frameworkweblogic-framework Deserialization of Untrusted Data vulnerability9.8 Critical
- esotericsoftware yamlbeansEsoteric YamlBeans Unsafe Deserialization vulnerability7.8 High
- spring for apache kafka, vmware spring for apache kafka +1 moreJava Deserialization vulnerability in Spring-Kafka When Improperly Configured5.3 Medium
- alibabacloud nacos spring projectNacos Spring vulnerable to Unsafe Deserialization8.8 High
- dataprobe iboot pdu, iboot-pdu4-c20 firmware, iboot-pdu4-n20 firmware +20 more +22 moreThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to...9.8 Critical
- huawei emui, harmonyos +1 moreDeserialization vulnerability in the input module. Successful exploitation of this vulnerability...7.5 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.8 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- rs485 logisticspipesDeserialization of Untrusted Data in network IO8.1 High
- aerospike java client, aerospike-client-java +1 moreAerospike Java Client vulnerable to unsafe deserialization of server responses9.8 Critical
- ibm sdk, sdk, java technology edition +1 moreIBM SDK, Java Technology Edition code execution8.1 High
- ibm b2b advanced communications, multi-enterprise integration gateway +1 moreIBM B2B Advanced Communication denial of service7.5 High
- ultralytics yolov3Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary...7.8 High
- ultralytics yolov5Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary...7.8 High
- apache helixApache Helix: Deserialization vulnerability in Helix workflow and REST9.8 Critical
- apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 moreApache Jackrabbit RMI access can lead to RCE9.8 Critical
- apache inlongApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param7.5 High
- abb ability™ zenon, zenon +1 moreInsecure deserialization in zenon internal DLLs6.3 Medium
- adobe coldfusionAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE9.8 Critical
- apache shardingsphere, apache software foundation shardingsphere-agent +1 moreShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent8.8 High
- apache eventmesh, eventmesh-connector-rabbitmq, apache software foundation eventmesh (incubating) rabbitmq connector +2 moreApache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data9.8 Critical
- razer centralRazerCentralService Unsafe Deserialization Escalation of Privilege7.8 High
- honeywell c300, c300 firmware +1 moreController stack overflow on decoding messages from the server9.8 Critical
- wpeverest user registration, user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder +1 moreUser Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- adobe coldfusionAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution9.8 Critical
- orchid platformOrchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution9.7 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +6 more +8 moreWindows Server Update Service (WSUS) Elevation of Privilege Vulnerability7.8 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Deserialization of Untrusted Data9.8 Critical
- apache johnzonApache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale5.3 Medium
- ivanti endpoint managerA deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an...9.8 Critical
- medtronic paceart optimaMedtronic Paceart MSMQ Deserialization of Untrusted Data9.8 Critical
- fortinet fortinacA deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8...9.6 Critical
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...7.1 High
- solonSolon vulnerable to deserialization of untrusted data9.8 Critical
- whaleal icefrogwhaleal IceFrog Aviator Template Engine deserialization5.5 Medium
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- schneider electric igss dashboard (dashboard.exe), schneider-electric igss dashboard +1 moreA CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that...7.8 High
- crmebZhong Bang CRMEB PublicController.php put_image deserialization4.3 Medium
- Show moreLoading…