CWE-502 · Deserialization of Untrusted Data (page 20)
Page 20 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43931 | Critical | 9.8 | 2024-08-29 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3. |
CVE-2022-2440 | High | 7.2 | 2024-08-29 | The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8… |
CVE-2024-8030 | Critical | 9.8 | 2024-08-28 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is v… |
CVE-2024-7351 | High | 7.2 | 2024-08-24 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted i… |
CVE-2024-5335 | Critical | 9.8 | 2024-08-21 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is v… |
CVE-2024-42363 | High | 8.8 | 2024-08-20 | Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the Role… |
CVE-2024-42362 | High | 8.8 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. Th… |
CVE-2024-8003 | Low | 3.5 | 2024-08-20 | A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/a… |
CVE-2024-5932 | Critical | 10.0 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 v… |
CVE-2024-43354 | Critical | 9.8 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2. |
CVE-2024-43252 | Critical | 9.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1. |
CVE-2024-43242 | Critical | 9.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a… |
CVE-2024-37099 | Critical | 10.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1. |
CVE-2024-28986 | Critical | 9.8 | 2024-08-13 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2024-43141 | Critical | 9.8 | 2024-08-13 | Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants… |
CVE-2024-7561 | High | 8.8 | 2024-08-08 | The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from… |
CVE-2024-7560 | High | 7.2 | 2024-08-08 | The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input fro… |
CVE-2024-7486 | High | 8.8 | 2024-08-08 | The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input t… |
CVE-2024-36131 | High | 8.8 | 2024-08-07 | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on t… |
CVE-2024-39636 | High | 8.3 | 2024-08-01 | Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1. |
CVE-2024-39630 | Medium | 5.5 | 2024-08-01 | Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedu… |
CVE-2024-6152 | High | 8.8 | 2024-07-27 | The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input… |
CVE-2024-39673 | Medium | 6.8 | 2024-07-25 | Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confiden… |
CVE-2024-7067 | Medium | 6.3 | 2024-07-24 | A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by… |
CVE-2024-6327 | Critical | 9.9 | 2024-07-24 | In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vul… |
CVE-2024-6794 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploi… |
CVE-2024-6793 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation… |
CVE-2024-6675 | High | 7.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-38759 | Medium | 5.4 | 2024-07-22 | Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2. |
CVE-2024-6960 | High | 7.5 | 2024-07-21 | The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of ser… |
CVE-2024-6944 | Medium | 6.3 | 2024-07-21 | A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file Pu… |
CVE-2024-6943 | Medium | 6.3 | 2024-07-21 | A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of t… |
CVE-2024-5726 | High | 8.8 | 2024-07-18 | The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untruste… |
CVE-2024-28074 | Critical | 9.6 | 2024-07-17 | It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the resear… |
CVE-2024-40624 | Critical | 9.8 | 2024-07-15 | TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses th… |
CVE-2023-49566 | High | 8.8 | 2024-07-15 | In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager… |
CVE-2023-46801 | High | 8.8 | 2024-07-15 | In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_2… |
CVE-2024-6645 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-6644 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file Calcula… |
CVE-2024-31317 | High | 7.8 | 2024-07-09 | In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserializati… |
CVE-2024-38094 | High | 7.2 | 2024-07-09 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2024-38024 | High | 7.2 | 2024-07-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-38023 | High | 7.2 | 2024-07-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-32737 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryF… |
CVE-2023-32735 | Medium | 6.5 | 2024-07-09 | A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATI… |
CVE-2022-45147 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP… |
CVE-2024-37502 | Medium | 5.4 | 2024-07-09 | Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a throug… |
CVE-2024-5488 | Critical | 9.8 | 2024-07-09 | The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can… |
CVE-2024-6525 | Low | 2.7 | 2024-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-6441 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/mai… |
CVE-2024-36984 | High | 8.8 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use… |
CVE-2024-29040 | Medium | 4.3 | 2024-06-28 | This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to… |
CVE-2024-39705 | Critical | 9.8 | 2024-06-27 | NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used… |
CVE-2024-5016 | High | 7.2 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-39334 | Medium | 6.5 | 2024-06-23 | MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this trans… |
CVE-2024-32030 | High | 8.1 | 2024-06-19 | Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network addr… |
CVE-2024-35780 | High | 8.5 | 2024-06-19 | Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a thro… |
CVE-2024-5724 | High | 8.8 | 2024-06-19 | The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of un… |
CVE-2024-5649 | Medium | 5.4 | 2024-06-19 | The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted in… |
CVE-2024-5871 | Critical | 9.8 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of un… |
CVE-2024-5671 | Critical | 9.8 | 2024-06-14 | Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vul… |
CVE-2024-4371 | Critical | 9.0 | 2024-06-13 | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection… |
CVE-2024-3468 | | 2024-06-12 | There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive us… | |
CVE-2024-3467 | High | 7.8 | 2024-06-12 | There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileg… |
CVE-2024-28964 | High | 7.8 | 2024-06-12 | Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could p… |
CVE-2024-35249 | High | 8.8 | 2024-06-11 | Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability |
CVE-2024-36528 | High | 8.8 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/down… |
CVE-2024-5675 | Critical | 10.0 | 2024-06-06 | Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker… |
CVE-2024-33568 | High | 8.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro al… |
CVE-2024-37065 | High | 7.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on… |
CVE-2024-37064 | High | 7.8 | 2024-06-04 | Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset t… |
CVE-2024-37062 | High | 7.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to… |
CVE-2024-37060 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execut… |
CVE-2024-37059 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to… |
CVE-2024-37058 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentE… |
CVE-2024-37057 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow mo… |
CVE-2024-37056 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit… |
CVE-2024-37055 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model… |
CVE-2024-37054 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to… |
CVE-2024-37053 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn mod… |
CVE-2024-37052 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn mod… |
CVE-2024-3301 | High | 8.5 | 2024-05-30 | An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication remote code execution. |
CVE-2024-3300 | Critical | 9.0 | 2024-05-30 | An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution. |
CVE-2024-26289 | Critical | 9.8 | 2024-05-27 | Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1… |
CVE-2024-5352 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the comp… |
CVE-2024-5351 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs o… |
CVE-2024-5085 | High | 8.1 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserializa… |
CVE-2024-4471 | High | 8.0 | 2024-05-23 | The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deseriali… |
CVE-2024-4157 | High | 7.5 | 2024-05-22 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ver… |
CVE-2024-34274 | Low | 3.9 | 2024-05-21 | OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialize… |
CVE-2024-31879 | High | 7.5 | 2024-05-18 | IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the de… |
CVE-2024-34997 | High | 7.5 | 2024-05-17 | joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is… |
CVE-2024-4733 | High | 7.5 | 2024-05-16 | The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie… |
CVE-2024-34751 | Medium | 4.4 | 2024-05-16 | Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for Woo… |
CVE-2024-4838 | High | 7.5 | 2024-05-16 | The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input… |
CVE-2024-4200 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure dese… |
CVE-2024-3967 | High | 7.6 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deser… |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |