CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- thorntech sftp gateway, sftp gateway firmware +1 moreThorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of...9.8 Critical
- blakeblackshear frigateFrigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`7.5 High
- maca134 wp simple galleriesWP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection8.8 High
- apache activemq, activemq legacy openwire module, debian linux +3 more +5 moreApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack10.0 Critical
- nextgen mirth connectNextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote...9.8 Critical
- wpdeveloper essential blocks, wpdevteam essential blocks pro, gutenberg essential blocks – page builder for gutenberg blocks & patterns +2 moreEssential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries8.1 High
- automattic jetpack crm, jetpack crm – clients, leads, invoices, billing, email marketing, & automation +1 moreJetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization7.5 High
- wpdeveloper essential blocks, essential blocks pro, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +2 moreEssential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products8.1 High
- vmware aria operations for logsVMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with...7.8 High
- sollace unicopiaSollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing...7.5 High
- solarwinds access rights managerSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability8.0 High
- solarwinds access rights managerSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- solarwinds access rights managerSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- solarwinds access rights managerSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability8.0 High
- apache inlongApache inlong has an Arbitrary File Read Vulnerability7.5 High
- spring amqp, vmware spring advanced message queuing protocol +1 moreSpring AMQP Deserialization Vulnerability5.0 Medium
- xuexueli xxl-rpcRemote code execution in XXL-RPC9.1 Critical
- ivanti endpoint managerUnsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti...9.8 Critical
- imagely nextgen gallery, unknown wordpress gallery plugin +1 moreNextGEN Gallery < 3.39 - Admin+ PHAR Deserialization7.5 High
- shortpixel enable media replaceEnable Media Replace < 4.1.3 - Author+ PHP Object Injection8.8 High
- unknown weaver xtreme theme supportWeaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection7.2 High
- edmon.parker read more & accordion, edmonsoft read more \& accordion +1 moreRead More & Accordion < 3.2.7 - Admin+ PHP Object Injection7.2 High
- apache inlongApache InLong: Jdbc Connection Security Bypass in InLong9.8 Critical
- vantage6vantage6's Pickle serialization is insecure5.5 Medium
- gardenArbitrary code execution vulnerability when using shared Kubernetes cluster8.3 High
- geokit geokit-railsgeokit-rails Command Injection vulnerability8.3 High
- presto-changeo test site creatorPresto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization...9.8 Critical
- redissonRedisson unsafe deserialization vulnerability9.7 Critical
- schneider electric ecostruxure power monitoring expert, ecostruxure power operation (epo) with advanced reports, ecostruxure power scada operation with advanced reports +1 more +3 moreA?CWE-502:?Deserialization of untrusted data?vulnerability exists?that could allow an attacker...9.8 Critical
- afterlogic aurora filesA deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute...8.8 High
- deyue remote vehicle management system project remote vehicle management systemDeyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization...8.8 High
- google androidIn appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe...5.5 Medium
- apache avro, apache software foundation avro java sdk +1 moreApache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK7.5 High
- consensys gnark-cryptoDuplicate Advisory: Consensys gnark-crypto allows Signature Malleability9.8 Critical
- progress ws ftp serverWS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability10.0 Critical
- illumio core pce, core policy compute engine +1 moreAuthenticated RCE due to unsafe JSON deserialization9.9 Critical
- emlogDeserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to...9.8 Critical
- phppgadmin project phppgadminphpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead...9.8 Critical
- ssssssss spider-flowspider-flow API DataSourceController.java DriverManager.getConnection deserialization6.3 Medium
- adobe coldfusionBypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 89.8 Critical
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Information Disclosure Vulnerability5.7 Medium
- microsoft azure devops server, azure devops server 2019.0.1, azure devops server 2020.0.2 +2 more +4 moreAzure DevOps Server Remote Code Execution Vulnerability7.0 High
- microsoft identity linux brokerMicrosoft Identity Linux Broker Remote Code Execution Vulnerability4.4 Medium
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- tms-outsource wpdatatableswpDataTables < 2.1.66 - Admin+ PHP Object Injection7.2 High
- dieboldnixdorf agilis xfs for optevaAn issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary...9.8 Critical
- redwood jscape mft, redwood software jscape mft server +1 moreJSCAPE MFT Server Unsafe Deserialization on Management Port7.2 High
- Show moreLoading…