CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- seppmail ag secure email gateway (seg)Unsafe deserialization in the REST interface8.6 High
- jenkins project performance pluginJenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that...8.8 High
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from...8.8 High
- jenkins project jenkinsIn Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins...8.8 High
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field...4.3 Medium
- unknown weaver show postsWeaver Show Posts < 1.8.1 - Admin+ PHP Object Injection3.3 Low
- saturday drive ninja forms - layout & stylesWordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability8.8 High
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability8.8 High
- unknown user frontendWP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form8.8 High
- cypht-org cyphtCypht < 2.12.2 PHP Object Injection RCE via back_query Parameter8.7 High
- elastic elasticsearchDeserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution8.8 High
mlflowPyPIMLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact8.8 High- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- modelscopeModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading8.7 High
- fasterxml jackson-databindjackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types5.6 Medium
- tickeraWordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability9.8 Critical
- opensearch, amazon opensearch service, aws amazon opensearch service +2 moreUnrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination8.7 High
- ash-project ash cloakUnsafe deserialization of decrypted terms enables node DoS in AshCloak5.9 Medium
- unknown user profile builderProfile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export6.6 Medium
- pimcorePimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column9.3 Critical
- rank math seo math seoWordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability7.2 High
- Show moreLoading…