CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- webhuntinfotech universal sliderUniversal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection5.4 Medium
- wpweb woocommerce - social login, woocommerce social login +1 moreWooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection9.8 Critical
- trellix intrusion prevention system (ips) manager, intrusion prevention system manager +1 moreInsecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote...9.8 Critical
- codexpert codesigner, codesigner – all in one elementor woocommerce builder +1 moreCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection9.0 Critical
- aveva pi web apiDeserialization of Untrusted Data in AVEVA PI Web API8.4 High
- aveva pi asset framework clientDeserialization of Untrusted Data in AVEVA PI Asset Framework Client7.0 High
- dell common event enablerDell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization...7.8 High
- microsoft dynamics 365 business central, dynamics 365 business central 2023 release wave 1, dynamics 365 business central 2023 release wave 2 +1 more +3 moreMicrosoft Dynamics 365 Business Central Remote Code Execution Vulnerability8.8 High
- nukeviet, nukeviet egovernment +1 morenukeviet Deserialization of Untrusted Data vulnerability8.8 High
- summar mentor, summar software mentor – employee portal, summarsoftware mentor employee portal +2 moreUnreliable data deserialization vulnerability in Mentor10.0 Critical
typo3/phar-stream-wrapperPackagistBy-passing Protection of PharStreamWrapper InterceptorNo scoretypo3/cmsPackagistInsecure Deserialization & Arbitrary Code Execution in TYPO3 CMSNo scoretypo3/cmsPackagistInsecure Deserialization in TYPO3 CMSNo score- bdthemes element pack pro, element pack +1 moreWordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability8.5 High
- skops-dev skopsSkops unsafe deserialization7.8 High
- ydataai ydata-profilingydata unsafe deserialization7.8 High
- ydataai ydata-profilingydata unsafe deserialization7.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- lfprojects mlflowMLFlow unsafe deserialization8.8 High
- google androidIn multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation o…7.8 High
typo3/cms-corePackagistTYPO3 Possible Insecure Deserialization in Extbase Request Handling8.1 High- 3ds delmia aprisoPre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 20249.0 Critical
- 3ds delmia aprisoPost-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 20248.5 High
typo3/cms-corePackagistTYPO3 CMS Insecure Deserialization7.5 Highsymfony/symfonyPackagistSymfony XML decoding attack vector through external entities9.8 Critical- pmb services pmbRemote Code Inclusion Vulnerability in Multiple PMB Versions9.8 Critical
- anji-plus aj-reportanji-plus AJ-Report validationRules deserialization5.3 Medium
- anji-plus aj-reportanji-plus AJ-Report Javascript getValueFromJs deserialization5.3 Medium
- hashthemes hash form – drag & drop form builder, hash form +1 moreHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection8.1 High
- xpro addons — 140+ widgets for elementor140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection8.0 High
- javs viewerMalicious Code in Justice AV Solutions (JAVS) Viewer8.7 High
- fluentforms contact form, techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder +1 moreContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues7.5 High
- openbd bdclient spotOpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies...3.9 Low
- ibm iIBM i denial of service7.5 High
- joblib project joblibjoblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib...7.5 High
- plainware shiftcontroller, shiftcontroller employee shift scheduling +1 moreShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection7.5 High
- webtoffee order export & order import for woocommerceWordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability4.4 Medium
- brainstorm force convertplusConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection7.5 High
laravel/frameworkPackagistLaravel Cookie serialization vulnerabilityNo scoreilluminate/cookiePackagistLaravel Cookie serialization vulnerabilityNo score- progress telerik reportingProgress Telerik Reporting Local Deserialization Vulnerability7.7 High
- microfocus imanagerRemote Code Execution vulnerability in the iManager7.8 High
- microfocus imanagerRemote Code Execution vulnerability in the iManager7.6 High
- Show moreLoading…