CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- hyland onbase workflow timer serviceHyland OnBase Timer Service Unauthenticated .NET Remoting RCE9.3 Critical
- cesargb laravel-magiclinkLaravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution8.8 High
- infoblox niosIn Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.8.8 High
- zyddnys manga-image-translatormanga-image-translator Shared API Unsafe Deserialization RCE9.3 Critical
- tomdever wpforo forumwpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- unknown wp ecommerceWP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection6.5 Medium
- red hat ai inference server, enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 more +4 moreDiskCache has unsafe pickle deserialization9.8 Critical
- microsoft office, 365 apps, 365 apps for enterprise +12 more +14 moreMicrosoft Outlook Spoofing Vulnerability7.5 High
- microsoft azure ai language authoring, azure conversation authoring client library +1 moreAzure SDK for Python Remote Code Execution Vulnerability9.8 Critical
- sap netweaver, sap se netweaver (jms service) +1 moreInsecure Deserialization vulnerability in SAP NetWeaver (JMS service)4.4 Medium
- modery powerdocuPowerDocu Affected by Remote Code Execution via Insecure Deserialization7.8 High
- mylittleforum my little forum, my-little-forum mylittleforum +1 morePhar Deserialization leading to Arbitrary File Deletion in my little forum8.7 High
- tpadmin project tpadminyuan1994 tpadmin WebUploader preview.php deserialization6.9 Medium
- waterfutures epyt-flowEPyT-Flow has unsafe JSON deserialization (__type__)10.0 Critical
- craftcmsCraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution9.3 Critical
- blestaBlesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.7.2 High
- blestaBlesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.7.5 High
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability8.8 High
- jwohlwend boltzBoltz contains an insecure deserialization vulnerability in its molecule loading functionality8.4 High
- mmaitre314 picklescanpicklescan - Arbitrary File Creation via logging.FileHandler Deserialization6.9 Medium
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via Obfuscated eval Call9.3 Critical
- adlered bolo-solobolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization5.3 Medium
- vercel next.jsNext.js: Server-Side Request Forgery in Server Actions on Custom Servers8.3 High
- vercel next.jsNext.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies6.3 Medium
- vercel next.jsNext.js: Unbounded Server Action payload in Edge runtime6.3 Medium
- vercel next.jsNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname8.3 High
- vercel next.jsNext.js: Unauthenticated Disclosure of Internal Server Function endpoints6.3 Medium
- vercel next.jsNext.js: Cross-site scripting in App Router applications using CSP nonces4.7 Medium
- vercel next.jsNext.js: Cross-site scripting in beforeInteractive scripts with untrusted input6.1 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service via connection exhaustion in applications using Cache Components7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Server-side request forgery in applications using WebSocket upgrades8.6 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service in the Image Optimization API5.9 Medium
- vercel next.jsNext.js: Cache poisoning in React Server Component responses5.4 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in Pages Router applications using i18n7.5 High
- vercel next.jsNext.js: Middleware / Proxy redirects can be cache-poisoned3.7 Low
- vercel next.jsNext.js: HTTP request smuggling in rewrites6.3 Medium
- vercel next.jsNext.js: Unbounded next/image disk cache growth can exhaust storage6.9 Medium
- facebook react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 moreNext.js HTTP request deserialization can lead to DoS when using insecure React Server Components7.5 High
- solarwinds web help deskSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- solarwinds web help deskSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Critical
- phpunit project phpunit, debian linux +1 morePHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling7.8 High
- linuxfoundation pytorch, red hat openshift ai (rhoai), openshift ai 2.25 +2 morePyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files8.8 High
- datavane tisA XStream Security Vulnerability in XML Deserialization in datavane/tis10.0 Critical
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +3 more +5 moreReact Server Components have multiple Denial of Service Vulnerabilities7.5 High
- apache karaf decanter, apache software foundation karaf +1 moreApache Karaf: Decanter log-socket collector has deserialization vulnerability3.7 Low
- anritsu vectorstarAnritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- anritsu vectorstarAnritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- anritsu shocklineAnritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- upsonicUpsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability9.8 Critical
- Show moreLoading…