CWE-502 · Deserialization of Untrusted Data (page 23)
Page 23 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3334 | High | 7.2 | 2022-10-31 | The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin impor… |
CVE-2022-40238 | High | 8.8 | 2022-10-26 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-3335 | High | 7.2 | 2022-10-25 | The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections is… |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-38108 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-36958 | High | 8.8 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |
CVE-2022-36957 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-43019 | Critical | 9.8 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. |
CVE-2022-23734 | High | 8.8 | 2022-10-19 | A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBri… |
CVE-2022-21624 | Low | 3.7 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Or… |
CVE-2022-39198 | Critical | 9.8 | 2022-10-18 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects… |
CVE-2022-40889 | Critical | 9.8 | 2022-10-18 | Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php. |
CVE-2022-22241 | High | 8.1 | 2022-10-18 | An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without pro… |
CVE-2022-3291 | Medium | 6.5 | 2022-10-17 | Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitiv… |
CVE-2022-39311 | Critical | 9.1 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-39298 | High | 7.7 | 2022-10-12 | MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc… |
CVE-2022-39297 | High | 7.7 | 2022-10-12 | MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserial… |
CVE-2018-18447 | Critical | 9.8 | 2022-10-12 | dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2). |
CVE-2018-18446 | Critical | 9.8 | 2022-10-12 | dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2). |
CVE-2022-31680 | Critical | 9.1 | 2022-10-07 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter s… |
CVE-2022-26472 | High | 7.8 | 2022-10-07 | In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-26471 | High | 7.8 | 2022-10-07 | In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional… |
CVE-2022-41082 | High | 8.0 | 2022-10-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-42004 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent us… |
CVE-2022-42003 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserialize… |
CVE-2022-40314 | Critical | 9.8 | 2022-09-30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
CVE-2022-39256 | Critical | 9.0 | 2022-09-27 | Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on… |
CVE-2022-2903 | High | 7.2 | 2022-09-26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when… |
CVE-2022-36944 | Critical | 9.8 | 2022-09-23 | Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java… |
CVE-2022-41237 | Critical | 9.8 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2022-40955 | High | 8.8 | 2022-09-20 | In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data… |
CVE-2022-39008 | Critical | 9.1 | 2022-09-16 | The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and w… |
CVE-2022-38352 | Critical | 9.8 | 2022-09-15 | ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allo… |
CVE-2022-36038 | High | 8.8 | 2022-09-06 | CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVe… |
CVE-2022-2442 | High | 7.2 | 2022-09-06 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to… |
CVE-2022-2438 | High | 7.2 | 2022-09-06 | The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.1… |
CVE-2022-2436 | High | 8.8 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and incl… |
CVE-2022-2434 | High | 8.8 | 2022-09-06 | The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and incl… |
CVE-2022-2433 | High | 7.5 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' paramete… |
CVE-2022-2830 | High | 8.8 | 2022-09-05 | Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe comman… |
CVE-2022-29063 | Critical | 9.8 | 2022-09-02 | The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosti… |
CVE-2022-37023 | Medium | 6.5 | 2022-08-31 | Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to… |
CVE-2022-37022 | High | 8.8 | 2022-08-31 | Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing t… |
CVE-2022-37021 | Critical | 9.8 | 2022-08-31 | Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user st… |
CVE-2022-34668 | Critical | 9.8 | 2022-08-29 | NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacke… |
CVE-2022-36119 | High | 8.8 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-2465 | High | 8.6 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench… |
CVE-2021-25642 | High | 8.8 | 2022-08-25 | ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attac… |
CVE-2021-4178 | Medium | 6.7 | 2022-08-24 | A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML par… |
CVE-2021-4125 | High | 8.1 | 2022-08-24 | It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup… |
CVE-2022-33900 | Medium | 4.1 | 2022-08-22 | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. |
CVE-2022-29805 | Critical | 9.8 | 2022-08-19 | A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a craft… |
CVE-2022-2886 | Medium | 5.0 | 2022-08-19 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is… |
CVE-2022-2870 | Medium | 4.1 | 2022-08-17 | A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization… |
CVE-2022-36006 | High | 7.9 | 2022-08-15 | Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE)… |
CVE-2022-33947 | Medium | 5.4 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages… |
CVE-2022-28684 | High | 8.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulner… |
CVE-2022-35223 | Critical | 9.8 | 2022-08-02 | EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload w… |
CVE-2022-30287 | High | 8.0 | 2022-07-28 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads t… |
CVE-2022-35872 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User inte… |
CVE-2022-35870 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although… |
CVE-2022-33320 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33318 | Critical | 9.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33316 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33315 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-21549 | Medium | 5.3 | 2022-07-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-27580 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an at… |
CVE-2022-27579 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 al… |
CVE-2022-35405 | Critical | 9.8 | 2022-07-19 | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEn… |
CVE-2022-24082 | Critical | 9.8 | 2022-07-19 | If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly… |
CVE-2022-1984 | Medium | 4.5 | 2022-07-19 | This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow lo… |
CVE-2022-2444 | High | 8.8 | 2022-07-18 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' paramete… |
CVE-2022-2437 | Critical | 9.8 | 2022-07-18 | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter… |
CVE-2021-41419 | Critical | 9.8 | 2022-07-18 | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. |
CVE-2022-30981 | High | 8.8 | 2022-07-17 | An issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an attacker is able to deserialize arbitrary data and hence can potent… |
CVE-2021-36665 | High | 7.8 | 2022-07-12 | An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. |
CVE-2022-31605 | Critical | 9.8 | 2022-07-01 | NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The de… |
CVE-2022-31604 | Critical | 9.8 | 2022-07-01 | NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe de… |
CVE-2022-31115 | High | 8.8 | 2022-06-30 | opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YA… |
CVE-2022-33107 | Critical | 9.8 | 2022-06-29 | ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.p… |
CVE-2022-20195 | Medium | 5.0 | 2022-06-15 | In the keystore library, there is a possible prevention of access to system Settings due to unsafe deserialization. This could lead to local denial of service… |
CVE-2022-29615 | Low | 3.4 | 2022-06-14 | SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confide… |
CVE-2021-35095 | High | 8.4 | 2022-06-14 | Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in… |
CVE-2022-25863 | High | 8.1 | 2022-06-10 | The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the… |
CVE-2022-25845 | High | 8.1 | 2022-06-10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whi… |
CVE-2022-1660 | Critical | 9.8 | 2022-06-02 | The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remote… |
CVE-2022-29875 | Critical | 9.8 | 2022-06-01 | A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A… |
CVE-2021-32935 | High | 8.8 | 2022-05-23 | The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to… |
CVE-2022-28948 | High | 7.5 | 2022-05-19 | An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input. |
CVE-2022-1118 | High | 8.6 | 2022-05-17 | Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for T… |
CVE-2022-24108 | Critical | 9.8 | 2022-05-17 | The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resul… |
CVE-2022-0573 | High | 8.8 | 2022-05-16 | JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote… |
CVE-2022-29363 | Critical | 9.8 | 2022-05-12 | Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php. This vulnerability allows attackers to g… |
CVE-2022-1463 | High | 8.8 | 2022-05-10 | The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1… |
CVE-2021-23592 | High | 7.7 | 2022-05-06 | The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. |
CVE-2020-23621 | Critical | 9.8 | 2022-05-02 | The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of u… |
CVE-2020-23620 | Critical | 9.8 | 2022-05-02 | The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplie… |
CVE-2022-25767 | Critical | 9.8 | 2022-05-01 | All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitr… |
CVE-2022-25647 | High | 7.7 | 2022-05-01 | The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which… |