CWE-502 · Deserialization of Untrusted Data (page 18)
Page 18 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3300 | Critical | 9.0 | 2024-05-30 | An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution. |
CVE-2024-26289 | Critical | 9.8 | 2024-05-27 | Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1… |
CVE-2024-5352 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the comp… |
CVE-2024-5351 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs o… |
CVE-2024-5085 | High | 8.1 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserializa… |
CVE-2024-4471 | High | 8.0 | 2024-05-23 | The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deseriali… |
CVE-2024-4157 | High | 7.5 | 2024-05-22 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ver… |
CVE-2024-34274 | Low | 3.9 | 2024-05-21 | OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialize… |
CVE-2024-31879 | High | 7.5 | 2024-05-18 | IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the de… |
CVE-2024-34997 | High | 7.5 | 2024-05-17 | joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is… |
CVE-2024-4733 | High | 7.5 | 2024-05-16 | The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie… |
CVE-2024-34751 | Medium | 4.4 | 2024-05-16 | Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for Woo… |
CVE-2024-4838 | High | 7.5 | 2024-05-16 | The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input… |
CVE-2024-4200 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure dese… |
CVE-2024-3967 | High | 7.6 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deser… |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |
CVE-2024-30044 | High | 7.2 | 2024-05-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-30042 | High | 7.8 | 2024-05-14 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2024-4699 | Medium | 6.3 | 2024-05-14 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230922. This issue affects some… |
CVE-2024-4606 | Medium | 5.4 | 2024-05-14 | Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/… |
CVE-2024-4413 | Critical | 9.8 | 2024-05-14 | The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted… |
CVE-2024-4044 | High | 7.8 | 2024-05-14 | A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Succ… |
CVE-2024-3954 | High | 8.8 | 2024-05-14 | The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditt… |
CVE-2024-3070 | Critical | 9.8 | 2024-05-14 | The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization… |
CVE-2024-34433 | Medium | 4.4 | 2024-05-14 | Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0. |
CVE-2024-2290 | High | 7.2 | 2024-05-14 | The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input… |
CVE-2024-29800 | High | 8.0 | 2024-05-14 | Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0. |
CVE-2024-29212 | Critical | 9.9 | 2024-05-14 | Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its compone… |
CVE-2024-28075 | Critical | 9.0 | 2024-05-14 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2024-27281 | Medium | 4.5 | 2024-05-14 | An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a… |
CVE-2023-38264 | Medium | 5.9 | 2024-05-14 | The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service a… |
CVE-2024-22460 | Low | 2.2 | 2024-05-08 | Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. A remote attacker with high privileges could potentiall… |
CVE-2024-26579 | Critical | 9.8 | 2024-05-08 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using… |
CVE-2024-34515 | High | 8.8 | 2024-05-05 | image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists(). |
CVE-2024-3240 | High | 8.8 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input… |
CVE-2024-34075 | Medium | 6.2 | 2024-05-03 | kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Ma… |
CVE-2024-34072 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer mo… |
CVE-2023-51576 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2023-50223 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote att… |
CVE-2023-50222 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remo… |
CVE-2023-50221 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allow… |
CVE-2023-50220 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers t… |
CVE-2023-50219 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe… |
CVE-2023-50218 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2023-39476 | Critical | 9.8 | 2024-05-03 | Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote at… |
CVE-2023-39475 | Critical | 9.8 | 2024-05-03 | Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability… |
CVE-2023-39473 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote a… |
CVE-2024-1897 | High | 7.5 | 2024-05-02 | The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserial… |
CVE-2024-1896 | High | 7.5 | 2024-05-02 | The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object… |
CVE-2023-7064 | High | 7.5 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via d… |
CVE-2024-3591 | Medium | 6.5 | 2024-05-01 | The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated us… |
CVE-2024-1895 | High | 7.5 | 2024-04-30 | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc… |
CVE-2024-27322 | High | 8.8 | 2024-04-29 | Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling… |
CVE-2024-33641 | Medium | 5.4 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3. |
CVE-2024-33553 | Critical | 9.0 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5. |
CVE-2024-32876 | High | 8.5 | 2024-04-24 | NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new devi… |
CVE-2024-32835 | Medium | 5.4 | 2024-04-24 | Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2… |
CVE-2024-32817 | Medium | 4.4 | 2024-04-24 | Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Impor… |
CVE-2024-4019 | Medium | 6.3 | 2024-04-20 | A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /impo… |
CVE-2024-32600 | High | 8.3 | 2024-04-18 | Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5. |
CVE-2024-32603 | High | 8.5 | 2024-04-18 | Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20. |
CVE-2024-32431 | Medium | 4.4 | 2024-04-15 | Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2. |
CVE-2024-3740 | Medium | 6.3 | 2024-04-13 | A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPag… |
CVE-2024-3054 | High | 7.2 | 2024-04-12 | WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untru… |
CVE-2024-27985 | Medium | 5.4 | 2024-04-11 | Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9. |
CVE-2024-3568 | Critical | 9.6 | 2024-04-10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` fu… |
CVE-2024-3020 | High | 7.2 | 2024-04-10 | The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the '… |
CVE-2024-2693 | High | 8.8 | 2024-04-09 | The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted i… |
CVE-2024-2501 | High | 7.5 | 2024-04-09 | The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.33.1… |
CVE-2024-1813 | Critical | 9.8 | 2024-04-09 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted i… |
CVE-2024-1792 | High | 7.5 | 2024-04-09 | The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from th… |
CVE-2024-31224 | Critical | 9.8 | 2024-04-08 | GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deseri… |
CVE-2024-3431 | Medium | 4.7 | 2024-04-07 | A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=… |
CVE-2024-31308 | Medium | 4.4 | 2024-04-07 | Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26. |
CVE-2024-31277 | High | 8.7 | 2024-04-07 | Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32. |
CVE-2024-3366 | Low | 3.5 | 2024-04-06 | A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job… |
CVE-2024-31211 | Medium | 5.5 | 2024-04-04 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()… |
CVE-2024-2008 | High | 8.8 | 2024-04-04 | The Modal Popup Box – Popup Builder, Show Offers And News in Popup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ… |
CVE-2024-27604 | Critical | 9.8 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized. |
CVE-2023-51570 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-29433 | Critical | 9.8 | 2024-04-01 | A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data. |
CVE-2024-31094 | High | 8.5 | 2024-03-31 | Deserialization of Untrusted Data vulnerability in Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a… |
CVE-2024-3018 | High | 8.8 | 2024-03-30 | The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization… |
CVE-2024-1872 | High | 8.8 | 2024-03-29 | The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in th… |
CVE-2024-1858 | Medium | 5.4 | 2024-03-29 | The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via de… |
CVE-2023-23649 | High | 8.1 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2… |
CVE-2024-30221 | Medium | 5.4 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a t… |
CVE-2024-30230 | High | 8.2 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For… |
CVE-2024-30229 | High | 8.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2. |
CVE-2024-30228 | Critical | 9.9 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4. |
CVE-2024-30227 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4. |
CVE-2024-30226 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3. |
CVE-2024-30225 | Critical | 10.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10. |
CVE-2024-30224 | Critical | 10.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2. |
CVE-2024-30223 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26. |
CVE-2024-30222 | High | 8.5 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26. |
CVE-2024-1770 | High | 8.8 | 2024-03-28 | The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted in… |
CVE-2024-24842 | High | 8.7 | 2024-03-27 | Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for… |
CVE-2023-27459 | High | 7.4 | 2024-03-26 | Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1. |
CVE-2024-24725 | High | 8.8 | 2024-03-23 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin… |