CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- gfi archiverGFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- gfi archiverGFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- splunk enterprise, secure gateway +1 moreRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app8.8 High
- microsoft muzicMicrosoft/Muzic Remote Code Execution Vulnerability8.4 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability7.4 High
- siemens simatic s7-plcsim v16, simatic s7-plcsim v17, simatic step 7 safety v16 +36 more +38 moreA vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM...8.4 High
- notfound galleryGallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection8.8 High
shared_preferences_androidPubshared_preferences_android vulnerability3.0 Low- macwarrior clipbucket-v5, oxygenz clipbucket, clipbucket clickbucket +2 moreUntrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 1999.8 Critical
- macwarrior clipbucket-v5, oxygenz clipbucket, clipbucket clickbucket +2 moreUntrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below9.8 Critical
- apache hiveApache Hive: Deserialization of untrusted data when fetching partitions from the Metastore8.3 High
- horillahorilla create_skills deserialization5.3 Medium
- funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free, interactive contact form and multi step form builder with drag and drop editor funnelforms free +1 moreFunnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- No product listedInsecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.9.8 Critical
- jflyfox jfinal cmsJFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization...9.8 Critical
- apache arrow, apache software foundation arrow r package +1 moreApache Arrow R package: Arbitrary code execution when loading a malicious data file9.8 Critical
- hewlett packard enterprise insight remote supportA java deserialization vulnerability in HPE Remote Insight Support allows an unauthenticated...8.1 High
- valor apps easy folder listing proEasy Folder Listing Pro deserialization vulnerability9.3 Critical
- welliamcao opsmanagewelliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserialization5.3 Medium
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It...9.8 Critical
- veritas enterprise vaultAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It...9.8 Critical
- techjewel fluentsmtp – wp smtp plugin with amazon ses, sendgrid, mailgun, postmark, google and any smtp provider, wpmanageninja fluentsmtp +1 moreFluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection9.8 Critical
- hugging face transformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- hugging face transformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- hugging face transformersHugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability7.5 High
- allegraAllegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability7.2 High
- allegraAllegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability7.2 High
- allegraAllegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- allegraAllegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability9.8 Critical
- priyajain2802 grid view galleryGrid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection7.2 High
- drupal mailjetMailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-0626.6 Medium
- google androidIn writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch...7.8 High
- migrate cloneClone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'8.8 High
- mark o'donnell team rostersWordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerability9.8 Critical
- bueno labs pvt. ltd. xpresslane fast checkout, xpresslane fast checkout +1 moreWordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerability9.8 Critical
- masikonis geolocatorWordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerability9.8 Critical
- modeltheme qrmenu restaurant qr menu liteWordPress QRMenu Restaurant QR Menu Lite plugin <= 1.0.4 - PHP Object Injection vulnerability8.8 High
- google android, androidx.car.app +1 moreArbitrary Code execution in Car App Android Jetpack Library7.3 High
- bublick lis video gallery, lis video gallery +1 moreWordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability9.8 Critical
- nix solutions ltd anti-spam light, nixsolutions nix anti-spam light +1 moreWordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability9.8 Critical
- mindstien my geo posts freeWordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability9.8 Critical
- apache hertzbeatApache HertzBeat: RCE by notice template injection vulnerability8.8 High
- ajax-random-post project ajax-random-post, phan an ajax random posts +1 moreWordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerability9.8 Critical
- phoenixheart referrer detectorWordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability9.8 Critical
- flowcraft advanced personalizationWordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerability9.8 Critical
- Show moreLoading…