CWE-502 · Deserialization of Untrusted Data (page 19)
Page 19 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2025 | High | 8.8 | 2024-03-23 | The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions… |
CVE-2024-28861 | Critical | 9.8 | 2024-03-22 | Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Sym… |
CVE-2024-2054 | Critical | 9.8 | 2024-03-21 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-29032 | Medium | 5.3 | 2024-03-20 | Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting i… |
CVE-2024-1856 | High | 8.5 | 2024-03-20 | In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure dese… |
CVE-2024-1801 | High | 7.7 | 2024-03-20 | In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deser… |
CVE-2024-1800 | Critical | 9.9 | 2024-03-20 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vu… |
CVE-2024-2721 | High | 8.2 | 2024-03-20 | Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Butto… |
CVE-2024-29136 | High | 8.5 | 2024-03-19 | Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17. |
CVE-2024-2229 | High | 7.8 | 2024-03-18 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the applic… |
CVE-2024-1685 | High | 8.8 | 2024-03-16 | The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of un… |
CVE-2024-28859 | Medium | 5.0 | 2024-03-15 | Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony… |
CVE-2024-2006 | High | 8.8 | 2024-03-13 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in al… |
CVE-2024-1951 | High | 7.5 | 2024-03-13 | The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu… |
CVE-2024-1950 | High | 7.5 | 2024-03-13 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2024-1772 | High | 8.8 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i… |
CVE-2024-0047 | Medium | 5.5 | 2024-03-11 | In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local deni… |
CVE-2024-1773 | High | 8.8 | 2024-03-07 | The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via d… |
CVE-2024-28213 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsa… |
CVE-2024-28212 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. |
CVE-2024-28211 | Critical | 9.8 | 2024-03-07 | nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote… |
CVE-2024-26580 | Critical | 9.1 | 2024-03-06 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the speci… |
CVE-2024-1731 | High | 8.8 | 2024-03-05 | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrus… |
CVE-2024-0825 | High | 8.8 | 2024-03-05 | The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 vi… |
CVE-2024-24302 | Critical | 9.8 | 2024-03-03 | An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute ar… |
CVE-2024-0692 | High | 8.8 | 2024-03-01 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarW… |
CVE-2024-1859 | High | 8.8 | 2024-03-01 | The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includi… |
CVE-2024-22871 | High | 7.5 | 2024-02-29 | An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. |
CVE-2024-23328 | Critical | 9.1 | 2024-02-29 | Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execu… |
CVE-2024-23052 | Critical | 9.8 | 2024-02-29 | An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson… |
CVE-2023-51518 | Critical | 9.8 | 2024-02-27 | Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a dese… |
CVE-2024-1750 | Medium | 5.6 | 2024-02-22 | A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/image… |
CVE-2024-1748 | Medium | 5.0 | 2024-02-22 | A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of th… |
CVE-2023-51389 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuratio… |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |
CVE-2024-23114 | Critical | 9.8 | 2024-02-20 | Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Unde… |
CVE-2024-22369 | High | 7.8 | 2024-02-20 | Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22… |
CVE-2024-1651 | Critical | 10.0 | 2024-02-20 | Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserializatio… |
CVE-2023-52357 | High | 7.5 | 2024-02-18 | Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability. |
CVE-2024-20953 | High | 8.8 | 2024-02-17 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable… |
CVE-2024-23478 | High | 8.0 | 2024-02-15 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authent… |
CVE-2023-40057 | Critical | 9.0 | 2024-02-15 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |
CVE-2023-26592 | Low | 3.8 | 2024-02-14 | Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially ena… |
CVE-2024-23759 | Critical | 9.8 | 2024-02-12 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBoo… |
CVE-2024-23512 | High | 8.7 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerc… |
CVE-2023-46615 | Medium | 5.4 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7. |
CVE-2024-24926 | High | 7.5 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Crea… |
CVE-2024-24797 | Critical | 9.8 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essentia… |
CVE-2024-24796 | High | 8.2 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This… |
CVE-2024-23513 | High | 8.7 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5. |
CVE-2024-25100 | Critical | 10.0 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n… |
CVE-2024-1432 | Medium | 5.0 | 2024-02-11 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22 and classified as problematic. This issue affects… |
CVE-2024-1353 | Medium | 6.3 | 2024-02-09 | A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0. Affected by this issue is the function index of the file app/weixin/cont… |
CVE-2024-24590 | High | 8.0 | 2024-02-06 | Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded ar… |
CVE-2024-0668 | Medium | 6.6 | 2024-02-05 | The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of unt… |
CVE-2023-6933 | High | 8.8 | 2024-02-05 | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrust… |
CVE-2024-1225 | High | 7.3 | 2024-02-05 | A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /applic… |
CVE-2024-1198 | Medium | 6.3 | 2024-02-03 | A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User… |
CVE-2024-22320 | Critical | 9.8 | 2024-02-02 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2024-1032 | High | 7.3 | 2024-01-30 | A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/… |
CVE-2024-0960 | Medium | 5.0 | 2024-01-27 | A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads o… |
CVE-2024-0959 | Medium | 5.0 | 2024-01-27 | A vulnerability was found in StanfordVL GibsonEnv 0.3.1. It has been classified as critical. Affected is the function cloudpickle.load of the file gibson\utils… |
CVE-2024-20253 | Critical | 9.9 | 2024-01-26 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2024-0937 | Medium | 6.3 | 2024-01-26 | A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file… |
CVE-2024-0936 | Medium | 6.3 | 2024-01-26 | A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the com… |
CVE-2023-50943 | High | 7.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xco… |
CVE-2024-22309 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0. |
CVE-2024-22284 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2. |
CVE-2024-23636 | Critical | 9.8 | 2024-01-23 | SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a black… |
CVE-2017-20189 | Critical | 9.8 | 2024-01-22 | In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server d… |
CVE-2024-0739 | High | 7.3 | 2024-01-19 | A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. T… |
CVE-2022-45845 | Medium | 4.3 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9. |
CVE-2022-45083 | Medium | 6.6 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Pro… |
CVE-2024-0654 | Medium | 5.3 | 2024-01-18 | A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the fil… |
CVE-2024-20926 | Medium | 5.9 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported ver… |
CVE-2024-0603 | High | 7.3 | 2024-01-16 | A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The… |
CVE-2023-1405 | High | 7.5 | 2024-01-16 | The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gad… |
CVE-2023-6049 | Critical | 9.8 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perfor… |
CVE-2023-7032 | High | 7.8 | 2024-01-09 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges b… |
CVE-2024-21318 | High | 8.8 | 2024-01-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-52202 | Critical | 9.1 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player… |
CVE-2023-52206 | High | 7.7 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: L… |
CVE-2023-52205 | Critical | 9.1 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with… |
CVE-2023-52200 | Critical | 9.6 | 2024-01-08 | Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Mem… |
CVE-2023-6528 | High | 8.8 | 2024-01-08 | The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing s… |
CVE-2023-5235 | High | 8.8 | 2024-01-08 | The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers… |
CVE-2023-52207 | Critical | 9.1 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free… |
CVE-2023-52225 | Critical | 10.0 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UG… |
CVE-2023-52219 | Critical | 9.9 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1. |
CVE-2023-52218 | Critical | 10.0 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: fro… |
CVE-2024-0302 | Medium | 6.3 | 2024-01-08 | A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the… |
CVE-2023-49442 | Critical | 9.8 | 2024-01-03 | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request. |
CVE-2023-51785 | High | 7.5 | 2024-01-03 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary… |
CVE-2023-49777 | Critical | 9.1 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through… |
CVE-2023-52182 | Critical | 9.9 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes… |
CVE-2023-52181 | Critical | 10.0 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1. |
CVE-2023-51545 | Critical | 9.6 | 2023-12-29 | Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitme… |
CVE-2023-51505 | Critical | 10.0 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This i… |
CVE-2023-51470 | Critical | 9.9 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11… |
CVE-2023-51422 | Critical | 9.9 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings |… |