CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- yiiframework yii, yiisoft yii2 +1 moreyiisoft Yii2 MockClass.php generate deserialization5.3 Medium
- yiiframework yii, yiisoft yii2 +1 moreyiisoft Yii2 SortableIterator.php getIterator deserialization5.3 Medium
- opennetworking onosAn issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when...9.8 Critical
- aizuda snail-jobaizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization5.3 Medium
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- vercel next.jsAuthorization Bypass in Next.js Middleware9.1 Critical
- microsoft dataverseMicrosoft Dataverse Remote Code Execution Vulnerability8.7 High
- redlibRedlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form8.7 High
- veeam backup and recovery, backup \& replication +1 moreA vulnerability allowing remote code execution (RCE) for domain users.9.9 Critical
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- vllm, vllm-project vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllm9.8 Critical
- bentoml bentoml/bentomlDeserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml9.8 Critical
- infiniflow infiniflow/ragflow, ragflow +1 moreRemote Code Execution in infiniflow/ragflow9.8 Critical
- kedro-org kedro-org/kedroRemote Code Execution in kedro-org/kedro9.8 Critical
- open-mmlab open-mmlab/mmdetectionRemote Code Execution by Pickle Deserialization in open-mmlab/mmdetection9.8 Critical
- binary-husky binary-husky/gpt academic, gpt academic +1 moreDeserialization of Untrusted Data in binary-husky/gpt_academic8.8 High
- horovod, horovod horovod/horovod +1 moreUnauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod9.8 Critical
- modelscope modelscope/agentscopeRemote Code Execution via Deserialization in modelscope/agentscope9.8 Critical
- vllm-project vllm, vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllm9.8 Critical
- h2o, h2oai h2oai/h2o-3 +1 moreJdbc Deserialization in h2oai/h2o-39.8 Critical
- invoke-ai invoke-ai/invokeaiRemote Code Execution via Model Deserialization in invoke-ai/invokeai9.8 Critical
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server9.8 Critical
- applioApplio allows unsafe deserialization in infer.py8.9 High
- applioApplio allows unsafe deserialization in model_blender.py8.9 High
- applioApplio allows unsafe deserialization in inference.py8.9 High
- applioApplio allows unsafe deserialization in model_information.py8.9 High
- vllmvLLM Allows Remote Code Execution via Mooncake Integration9.1 Critical
- loftocean cozystay - hotel booking wordpress theme, tinysalt - personal food blog wordpress theme +1 moreCozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler9.8 Critical
- viames pair frameworkviames Pair Framework PHP Object UserRemember.php getCookieContent deserialization6.9 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager Plugin <= 2.2.6 - PHP Object Injection vulnerability8.8 High
- ibm qiskit, qiskit sdk +1 moreQiskit SDK code execution9.8 Critical
- potenzaglobalsolutions ciyashop, ciyashop - multipurpose woocommerce theme +1 moreCiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection9.8 Critical
- servmask all-in-one wp migration and backupAll in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection7.5 High
github.com/cheqd/cheqd-nodeGocheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement9.3 Critical- apache tomcat, debian linux, netapp bootstrap os +2 moreApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT9.8 Critical
- nintex automationNintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.8.5 High
- visicutVisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of...9.8 Critical
- bestwebsoft gallery by bestwebsoft – customizable image and photo galleries for wordpressGallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection7.2 High
- No product listedA vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting...9.8 Critical
- linzhaoguan pb-cmsLinZhaoguan pb-cms Add New Topic admin#themes deserialization5.1 Medium
- ni g web development softwareDeserialization of Untrusted Data Vulnerability in NI G Web Development Software8.4 High
dglPyPIdmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()8.9 High- designthemes veda - multipurpose wordpress themeVEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection9.8 Critical
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection8.1 High
- fantasticplugins woocommerce recover abandoned cartWooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection8.1 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection9.8 Critical
- heinlein-support check mk python apiInsecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api7.7 High
- stiofan events calendar for geodirectory, wpgeodirectory events calendar* +1 moreWordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability8.8 High
- beaver builder wordpress assistantWordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerability7.2 High
- Show moreLoading…