CWE-502 · Deserialization of Untrusted Data (page 20)
Page 20 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51414 | Critical | 9.6 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing… |
CVE-2023-36381 | Medium | 6.6 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5. |
CVE-2023-32795 | High | 8.2 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3. |
CVE-2023-32513 | High | 7.5 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fun… |
CVE-2023-51700 | Medium | 6.4 | 2023-12-27 | Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile… |
CVE-2022-34268 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the ho… |
CVE-2023-49826 | High | 8.1 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad… |
CVE-2023-49778 | Critical | 10.0 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6. |
CVE-2023-32242 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Them… |
CVE-2023-51656 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade… |
CVE-2022-47599 | Medium | 5.5 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit… |
CVE-2023-7018 | High | 7.8 | 2023-12-20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-49773 | Critical | 10.0 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23. |
CVE-2023-49772 | Critical | 10.0 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0. |
CVE-2023-28782 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3. |
CVE-2023-47507 | High | 7.1 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5. |
CVE-2023-46147 | High | 7.4 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-40555 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose… |
CVE-2023-34382 | Medium | 4.4 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is… |
CVE-2023-34027 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0. |
CVE-2023-37390 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a thro… |
CVE-2023-6730 | High | 8.8 | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-49819 | High | 7.5 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON… |
CVE-2023-46154 | Medium | 6.6 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPre… |
CVE-2023-46279 | Critical | 9.8 | 2023-12-15 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest ver… |
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-50252 | High | 8.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attri… |
CVE-2023-6656 | Medium | 5.0 | 2023-12-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this… |
CVE-2023-6654 | Medium | 6.3 | 2023-12-10 | A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/sessi… |
CVE-2023-6580 | High | 8.8 | 2023-12-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component Q… |
CVE-2023-49297 | Low | 3.3 | 2023-12-05 | PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbi… |
CVE-2023-46674 | Medium | 6.0 | 2023-12-05 | An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by… |
CVE-2023-48967 | Critical | 9.8 | 2023-12-04 | Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data. |
CVE-2023-48887 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-48886 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-47207 | Critical | 9.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator… |
CVE-2023-48952 | High | 7.5 | 2023-11-29 | An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SE… |
CVE-2023-6378 | High | 7.1 | 2023-11-29 | A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending… |
CVE-2023-46990 | Critical | 9.8 | 2023-11-20 | Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace funct… |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2023-44353 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44351 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44350 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-47130 | High | 8.1 | 2023-11-14 | Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize(… |
CVE-2023-38177 | Medium | 6.1 | 2023-11-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-36439 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36050 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36039 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36035 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-46817 | Critical | 9.8 | 2023-11-03 | An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a… |
CVE-2023-47204 | Critical | 9.8 | 2023-11-02 | Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. |
CVE-2023-1714 | High | 8.8 | 2023-11-01 | Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitr… |
CVE-2023-47174 | Critical | 9.8 | 2023-10-31 | Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related is… |
CVE-2023-45672 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used… |
CVE-2023-5583 | High | 8.8 | 2023-10-30 | The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted inpu… |
CVE-2023-40121 | Medium | 5.5 | 2023-10-27 | In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosu… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-43208 | Critical | 9.8 | 2023-10-26 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the inc… |
CVE-2023-4386 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2022-3342 | High | 7.5 | 2023-10-20 | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' functio… |
CVE-2023-4402 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2023-39680 | High | 7.5 | 2023-10-20 | Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. |
CVE-2023-34052 | High | 7.8 | 2023-10-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the… |
CVE-2023-35186 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2023-35184 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a Solar… |
CVE-2023-35182 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on Solar… |
CVE-2023-35180 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds… |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2023-45146 | Critical | 9.0 | 2023-10-18 | XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism… |
CVE-2023-35084 | Critical | 9.8 | 2023-10-18 | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which co… |
CVE-2023-4971 | High | 7.2 | 2023-10-16 | The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues wh… |
CVE-2023-23930 | Medium | 5.5 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serializatio… |
CVE-2023-44392 | High | 8.2 | 2023-10-09 | Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is… |
CVE-2023-26153 | High | 8.3 | 2023-10-06 | Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. T… |
CVE-2023-43981 | Critical | 9.8 | 2023-10-05 | Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php. |
CVE-2023-42809 | Critical | 9.6 | 2023-10-04 | Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java object… |
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2023-43176 | High | 8.8 | 2023-10-03 | A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file. |
CVE-2023-43268 | High | 8.8 | 2023-10-02 | Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability. |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-44273 | Critical | 9.8 | 2023-09-28 | Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the… |
CVE-2023-5183 | Critical | 9.9 | 2023-09-27 | Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to e… |
CVE-2023-43291 | Critical | 9.8 | 2023-09-27 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. |
CVE-2023-40044 | Critical | 10.0 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer mod… |
CVE-2023-40619 | Critical | 9.8 | 2023-09-20 | phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is direct… |
CVE-2023-5016 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnect… |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-38204 | Critical | 9.8 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilit… |
CVE-2023-38155 | High | 7.0 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-36777 | Medium | 5.7 | 2023-09-12 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2023-36757 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36756 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36745 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36744 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36736 | Medium | 4.4 | 2023-09-12 | Microsoft Identity Linux Broker Remote Code Execution Vulnerability |
CVE-2023-35669 | High | 7.8 | 2023-09-11 | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. Th… |