CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- pencidesign soledad, soledad – multipurpose, newspaper, blog & woocommerce wordpress theme +1 moreWordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection8.1 High
- apache iotdbApache IoTDB: Unsafe deserialize map in Sync Tool9.8 Critical
- bitapps file manager, file manager by bit form team manager – 100% free & open source file manager plugin for wordpress | bit file manager +1 moreWordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection5.5 Medium
- huggingface huggingface/transformers, transformers +1 moreDeserialization of Untrusted Data in huggingface/transformers9.6 Critical
- bcorp shortcodes project shortcodes, tim brattberg bcorp shortcodes +1 moreWordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection10.0 Critical
- phpbits genesis simple loveWordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection10.0 Critical
- gravity forms forms, gravityforms gravity forms +1 moreWordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection8.3 High
- ux-themes flatsome | multi-purpose responsive woocommerce theme, uxthemes flatsome +1 moreWordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object Injection8.3 High
- themify ultraWordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection7.4 High
- averta master slider pro, master slider pro +1 moreWordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection7.1 High
- rajarora795 recently viewed productsWordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection8.3 High
- dokan, wedevs dokan – best woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy +1 moreWordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection4.4 Medium
- themesflat addons for elementorWordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection8.3 High
- huggingface huggingface/transformers, transformers +1 moreDeserialization of Untrusted Data in huggingface/transformers9.0 Critical
- e2pdf, e2pdf.com e2pdf – export to pdf tool for wordpress +1 moreWordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection6.6 Medium
- gordon böhme, antonio leutsch structured content (json-ld) #wpsc, wpsc-plugin structured content +1 moreWordPress Structured Content Plugin <= 1.5.3 is vulnerable to PHP Object Injection7.5 High
- apache dubboApache Dubbo: Bypass deny serialize list check in Apache Dubbo9.8 Critical
- apache dubboBypass serialize checks in Apache Dubbo9.8 Critical
- ibm i access client solutionsIBM i Access Client Solutions code execution7.4 High
- dompdf php-svg-libphp-svg-lib unsafe attributes merge when parsing `use` tag8.3 High
- dompdf php-svg-libphp-svg-lib possible DoS caused by infinite recursion when parsing SVG document5.3 Medium
- iperov deepfacelabDeepFaceLab DFLJPG.py deserialization5.0 Medium
- phpemsPHPEMS Session Data session.cls.php deserialization6.3 Medium
- d-link dir-846, dlink dir-846 firmware +1 moreD-Link DIR-846 QoS POST deserialization8.8 High
- iterative pydrive2Unsafe YAML deserialization in PyDrive23.3 Low
- elastic elasticsearch, elasticsearch-hadoop +1 moreElasticsearch-hadoop Unsafe Deserialization6.0 Medium
- noear solonSolon is vulnerable to Deserialization of Untrusted Data9.8 Critical
- fengjiachun jupiterJupiter allows attackers to execute arbitrary commands via sending a crafted RPC request9.8 Critical
- luxiaoxun nettyrpcA deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands...9.8 Critical
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Deserialization of Untrusted Data9.8 Critical
- qos logbackLogback "receiver" DOS vulnerability7.1 High
- openlinksw virtuosoAn issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows...7.5 High
- apache activemqApache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE8.8 High
- apache submarineApache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization9.8 Critical
- publiccmsDeserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute...9.8 Critical
ibis-frameworkPyPIIbis PyArrow dependency allows arbitrary code execution when loading a malicious data fileNo score- adobe coldfusionAdobe ColdFusion RCE Security Vulnerability9.8 Critical
- adobe coldfusionColdFusion WDDX Deserialization Gadgets9.8 Critical
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)9.8 Critical
- yiiframework yiiUnsafe deserialization of user data in yiisoft/yii8.1 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability8.0 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.0 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability6.1 Medium
- apache pyarrowPyArrow, PyArrow: Arbitrary code execution when loading a malicious data file9.8 Critical
- apache software foundation uima java sdk core, uima java sdk cpe, uima java sdk tools +2 more +4 moreApache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats8.8 High
- phpfoxAn issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core...9.8 Critical
- toumorokoshi transmute-coretransmute-core unsafe YAML deserialization vulnerability9.8 Critical
- bitrix24Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction8.8 High
- Show moreLoading…