CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedIn DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code...10.0 Critical
- guanxinglu vlarlGuanxingLu vlarl ZeroMQ reasoning_server.py run_reasoning_server deserialization5.3 Medium
- giantspatula sewkinectgiantspatula SewKinect Endpoint calculate pickle.loads deserialization5.3 Medium
- lazyagi lazyllmLazyAGI LazyLLM server.py lazyllm_call deserialization5.3 Medium
- geyang ml-loggergeyang ml-logger Ping server.py log_handler deserialization5.3 Medium
- apache iotdbApache IoTDB: Deserialization of untrusted Data5.3 Medium
- running-elephant datartDatart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the...8.8 High
- solarwinds web help deskSolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability9.8 Critical
- raoinfotech gsheets connectorWordPress GSheets Connector Plugin <= 1.1.1 - PHP Object Injection Vulnerability7.2 High
- conveythisWordPress ConveyThis plugin <= 269.1 - PHP Object Injection vulnerability7.2 High
- awesomesupport awesome supportWordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerability7.2 High
- jeecg jimureportjeecgboot JimuReport DB2 JDBC testConnection deserialization5.3 Medium
- jeecg jimureportjeecgboot JimuReport MySQL JDBC testConnection deserialization5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization5.3 Medium
- h2o, h2oai h2oai/h2o-3 +1 moreDeserialization Vulnerability in h2oai/h2o-39.8 Critical
- google kerasArbitrary Code execution in Keras Safe Mode8.6 High
- grokability, inc. snipe-itSnipe-IT allows unsafe deserialization6.8 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreDeserialization Vulnerability in GoAnywhere MFT's License Servlet10.0 Critical
- ninjaforms ninja formsNinja-forms < 3.11.1 - Unauthenticated PHP Objection9.8 Critical
- cloud jasperreports io, jasperreports library, jasperreports server +8 more +10 moreJaspersoft Library Deserialisation Vulnerability8.7 High
- getgreenshot greenshotGreenshot — Insecure .NET deserialization via WM_COPYDATA enables local code execution8.4 High
- apache foryApache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data6.5 Medium
- dataeaseDataease H2 data source JDBC URL validation bypass leads to remote code execution8.7 High
- dataeaseDataease has a JDBC attack vulnerability in the Impala datasource8.7 High
- 1panel-dev maxkb1Panel-dev MaxKB debug deserialization5.3 Medium
- seat queue ticket kioskSEAT Queue Ticket Kiosk Java RMI Registry deserialization2.3 Low
- lmsys sglanglmsys sglang update_weights_from_tensor main deserialization6.9 Medium
- microsoft hpc pack, hpc pack 2019 +1 moreMicrosoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability9.8 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- thememove coreWordPress ThemeMove Core Plugin <= 1.4.2 - PHP Object Injection Vulnerability8.8 High
- webdevstudios constant contact for wordpressWordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability8.8 High
- themegoods photographyWordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability9.0 Critical
- beckhoff te1000 | twincat 3 enineeringBeckhoff: Deserialization of untrusted data by TwinCAT 3 Engineering7.8 High
- sap se netweaver (rmi-p4)Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)10.0 Critical
- monai medical open network for ai, project-monai monai +1 moreMONAI's unsafe use of Pickle deserialization may lead to RCE8.8 High
- monai medical open network for ai, project-monai monai +1 moreMONAI's unsafe torch usage may lead to arbitrary code execution8.8 High
- apache jackrabbit, apache software foundation jackrabbit core, jackrabbit jcr commons +2 moreApache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory6.5 Medium
- axiomthemes smart seoWordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability9.8 Critical
- athemeart translations eds responsive menuWordPress eDS Responsive Menu Plugin <= 1.2 - PHP Object Injection Vulnerability7.2 High
- rubel miah aitasi coming soonWordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data Vulnerability7.2 High
- sitecore experience manager (xm), experience platform (xp), experience manager +4 more +6 moreSitecore Products ViewState Deserialization Vulnerability9.0 Critical
- fuji electric frenic-loader 4Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data8.4 High
- enituretechnology ltl freight quotes - tql editionWordPress LTL Freight Quotes - TQL Edition Plugin <= 1.2.6 - PHP Object Injection Vulnerability7.2 High
- enituretechnology ltl freight quotes – daylight editionWordPress LTL Freight Quotes – Daylight Edition Plugin <= 2.2.7 - PHP Object Injection Vulnerability7.2 High
- enituretechnology ltl freight quotes – day & ross editionWordPress LTL Freight Quotes – Day & Ross Edition Plugin <= 2.1.11 - PHP Object Injection Vulnerability7.2 High
- sitecore experience manager (xm), experience platform (xp), experience manager +3 more +5 moreSitecore Experience Remote Code Execution through Insecure Deserialization8.8 High
- freescoutFreeScout's deserialization of untrusted data can lead to Remote Code Execution8.6 High
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read6.5 Medium
- anritsu shocklineAnritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- Show moreLoading…