CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- opf openprojectOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`9.9 Critical
- uncanny owl automator proWordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability9.8 Critical
- inspirythemes realhomesWordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability8.8 High
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability9.8 Critical
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability8.1 High
- zaproxy zap-extensionsZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()8.7 High
- jetbrains kotlinJetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution6.7 Medium
- openidentityplatform openamOpenAM Unsafe Java Deserialization via SNS7.7 High
- eventprimeWordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability8.8 High
- composerMosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- openidentityplatform openamOpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage9.2 Critical
- feast-dev feast, red hat openshift ai (rhoai), openshift ai 3.4 +2 moreFeast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization9.3 Critical
- broadcom spring statemachine, spring statemachine +1 moreSpring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist8.8 High
- fasterxml jackson-databindjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1 High
- No product listedAn issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the...8.1 High
- nicolargo glancesGlances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution7.8 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- openidentityplatform opendj, org.openidentityplatform.opendj opendj-server-legacy +1 moreOpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI9.2 Critical
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments6.3 Medium
- linuxfoundation spinnakerSpinnaker: Non-safe yaml deserialization allowing RCE when using specific types8.8 High
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization5.3 Medium
- joomshaper.net sp lms extension for joomlaJoomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.49.5 Critical
vcrpyPyPIVCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files7.8 High- stanford stanzaStanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders7.5 High
- pontedilana php-weasyprintPhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)8.1 High
- microsoft .net, .net 8.0 runtime, .net 9.0 runtime +10 more +12 more.NET Remote Code Execution Vulnerability7.8 High
- microsoft .net, .net framework, .net 8.0 runtime +12 more +14 more.NET Framework Remote Code Execution Vulnerability7.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution9.5 Critical
- iba ibadatcoordinator, ibapda +1 moreDeserialization vulnerability in ibaPDA and ibaDatCoordinator9.3 Critical
- ptc flexplm, windchill and flexplm, windchill pdmlink +2 moreRemote Code Execution (RCE) vulnerability in Windchill PDMlink9.3 Critical
- nv-tlabs gen3cNVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API9.3 Critical
- emv creatifyWordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability9.8 Critical
- emv the hospitalWordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability9.8 Critical
- themeton the barber shopWordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability9.8 Critical
- themeton lagomWordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability9.8 Critical
- park of ideas modernoWordPress Moderno theme < 1.43 - PHP Object Injection vulnerability9.8 Critical
- mikado-themes châteauWordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability8.1 High
- mikado-themes zoyaWordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability8.1 High
- select-themes manufaktur solutionsWordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability8.1 High
- edge-themes eldonWordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability8.1 High
- mikado-themes shiftupWordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability8.1 High
- elated-themes singlemaltWordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability8.1 High
- select-themes hiroshiWordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability8.1 High
- elated-themes konseptWordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability8.1 High
- presslayouts alukasWordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability8.1 High
- presslayouts pressmartWordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability8.1 High
- pixel makers creative inc. entrepreneur - booking for small businesses wordpress themeWordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability8.8 High
- themerex plumbingWordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability9.8 Critical
- themerex reisenWordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability9.8 Critical
- quanos solutions gmbh schema st4Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation8.4 High
- Show moreLoading…