CWE-502 · Deserialization of Untrusted Data (page 16)
Page 16 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53912 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53911 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53910 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53909 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-9511 | Critical | 9.8 | 2024-11-23 | The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Inj… |
CVE-2024-11394 | High | 8.8 | 2024-11-22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2024-11393 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11392 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2024-5580 | High | 7.2 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5579 | High | 7.2 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-51642 | Medium | 6.3 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2023-51641 | Medium | 6.3 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-11409 | High | 7.2 | 2024-11-21 | The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted inp… |
CVE-2018-9474 | High | 7.8 | 2024-11-20 | In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local esc… |
CVE-2024-10913 | High | 8.8 | 2024-11-20 | The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the… |
CVE-2024-52445 | High | 8.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Rest… |
CVE-2024-52443 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1… |
CVE-2024-52440 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issu… |
CVE-2024-52439 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a t… |
CVE-2024-10382 | High | 7.5 | 2024-11-20 | There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitr… |
CVE-2024-52433 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo… |
CVE-2024-52432 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Ant… |
CVE-2024-52430 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: fr… |
CVE-2024-41151 | High | 8.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Ap… |
CVE-2024-52414 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue af… |
CVE-2024-52413 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <=… |
CVE-2024-52412 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1. |
CVE-2024-52411 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects A… |
CVE-2024-52410 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detecto… |
CVE-2024-52409 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Post… |
CVE-2021-3838 | Critical | 9.8 | 2024-11-15 | DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() func… |
CVE-2024-37285 | Critical | 9.1 | 2024-11-14 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful… |
CVE-2024-10962 | High | 8.8 | 2024-11-14 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deseriali… |
CVE-2024-43080 | High | 7.8 | 2024-11-13 | In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of… |
CVE-2024-52306 | High | 7.6 | 2024-11-13 | FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to… |
CVE-2024-10013 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerabil… |
CVE-2024-10012 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-10828 | High | 8.1 | 2024-11-13 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserializ… |
CVE-2024-8069 | High | 8.0 | 2024-11-12 | Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the sam… |
CVE-2024-44102 | Critical | 10.0 | 2024-11-12 | A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured)… |
CVE-2023-32736 | High | 7.3 | 2024-11-12 | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI… |
CVE-2024-47072 | High | 7.5 | 2024-11-08 | XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stac… |
CVE-2024-10749 | Medium | 5.0 | 2024-11-04 | A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67. Affected is the function script of the file /app/admin/controller/api/… |
CVE-2024-43383 | High | 8.0 | 2024-10-31 | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta000… |
CVE-2024-48112 | Critical | 9.8 | 2024-10-30 | A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
CVE-2024-10456 | Critical | 9.8 | 2024-10-30 | Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which coul… |
CVE-2024-50507 | Critical | 9.8 | 2024-10-30 | Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a… |
CVE-2024-48206 | Critical | 9.8 | 2024-10-29 | A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code. |
CVE-2024-48063 | Critical | 9.8 | 2024-10-29 | In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distribut… |
CVE-2024-50416 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affe… |
CVE-2024-50408 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2… |
CVE-2024-49684 | High | 7.2 | 2024-10-23 | Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Bac… |
CVE-2024-49625 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affe… |
CVE-2024-49624 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affect… |
CVE-2024-49332 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from… |
CVE-2024-49626 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue a… |
CVE-2024-10079 | High | 8.8 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted inpu… |
CVE-2024-49318 | Critical | 9.8 | 2024-10-17 | Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: f… |
CVE-2024-47836 | Low | 3.5 | 2024-10-16 | Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute… |
CVE-2024-49227 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock… |
CVE-2024-49226 | High | 8.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN… |
CVE-2024-49218 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injectio… |
CVE-2024-48030 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ric… |
CVE-2024-48028 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1. |
CVE-2024-48026 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager… |
CVE-2021-4451 | Medium | 6.6 | 2024-10-16 | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated a… |
CVE-2024-9634 | Critical | 9.8 | 2024-10-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 v… |
CVE-2024-21217 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported… |
CVE-2024-9953 | Medium | 4.9 | 2024-10-14 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arb… |
CVE-2024-45733 | High | 8.8 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a R… |
CVE-2024-9917 | Medium | 6.3 | 2024-10-13 | A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/templ… |
CVE-2024-48033 | Critical | 9.8 | 2024-10-11 | Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkb… |
CVE-2024-47074 | Critical | 9.8 | 2024-10-11 | DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connect… |
CVE-2024-47636 | Critical | 9.8 | 2024-10-10 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5… |
CVE-2023-25581 | | 2024-10-10 | pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects syst… | |
CVE-2024-9005 | | 2024-10-08 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is… | |
CVE-2024-9314 | High | 7.2 | 2024-10-05 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0… |
CVE-2024-47561 | High | 7.3 | 2024-10-03 | Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to ver… |
CVE-2024-8885 | High | 8.8 | 2024-10-02 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary file… |
CVE-2024-7434 | High | 8.8 | 2024-10-01 | The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of untrusted input. Th… |
CVE-2024-7433 | High | 8.8 | 2024-10-01 | The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. T… |
CVE-2024-7432 | High | 8.8 | 2024-10-01 | The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. T… |
CVE-2024-45772 | Medium | 5.1 | 2024-09-30 | Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. T… |
CVE-2024-8353 | Critical | 9.8 | 2024-09-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 v… |
CVE-2024-8922 | High | 8.8 | 2024-09-27 | The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includin… |
CVE-2024-43191 | High | 7.2 | 2024-09-26 | IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request. |
CVE-2024-8316 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-7576 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-8514 | Critical | 9.1 | 2024-09-25 | The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserial… |
CVE-2022-2439 | High | 7.2 | 2024-09-24 | The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'uploa… |
CVE-2024-42323 | High | 8.8 | 2024-09-21 | SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This… |
CVE-2024-8375 | High | 7.8 | 2024-09-19 | There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a… |
CVE-2024-5998 | High | 7.8 | 2024-09-17 | A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to th… |
CVE-2024-22399 | Critical | 9.8 | 2024-09-16 | Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client S… |
CVE-2024-8862 | High | 7.3 | 2024-09-14 | A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale… |
CVE-2022-2446 | High | 7.2 | 2024-09-13 | The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including… |
CVE-2024-41874 | Critical | 9.8 | 2024-09-13 | ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution… |
CVE-2024-28991 | Critical | 9.0 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an au… |
CVE-2024-45857 | High | 7.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrar… |
CVE-2024-45855 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |