CWE-502 · Deserialization of Untrusted Data (page 23)
Page 23 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46147 | High | 7.4 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-40555 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose… |
CVE-2023-34382 | Medium | 4.4 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is… |
CVE-2023-34027 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0. |
CVE-2023-37390 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a thro… |
CVE-2023-6730 | High | 8.8 | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-49819 | High | 7.5 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON… |
CVE-2023-46154 | Medium | 6.6 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPre… |
CVE-2023-46279 | Critical | 9.8 | 2023-12-15 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest ver… |
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-50252 | High | 8.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attri… |
CVE-2023-6656 | Medium | 5.0 | 2023-12-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this… |
CVE-2023-6654 | Medium | 6.3 | 2023-12-10 | A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/sessi… |
CVE-2023-6580 | High | 8.8 | 2023-12-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component Q… |
CVE-2023-49297 | Low | 3.3 | 2023-12-05 | PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbi… |
CVE-2023-46674 | Medium | 6.0 | 2023-12-05 | An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by… |
CVE-2023-48967 | Critical | 9.8 | 2023-12-04 | Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data. |
CVE-2023-48887 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-48886 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-47207 | Critical | 9.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator… |
CVE-2023-48952 | High | 7.5 | 2023-11-29 | An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SE… |
CVE-2023-6378 | High | 7.1 | 2023-11-29 | A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending… |
CVE-2023-46990 | Critical | 9.8 | 2023-11-20 | Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace funct… |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2023-44353 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44351 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44350 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-47130 | High | 8.1 | 2023-11-14 | Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize(… |
CVE-2023-38177 | Medium | 6.1 | 2023-11-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-36439 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36050 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36039 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36035 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-46817 | Critical | 9.8 | 2023-11-03 | An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a… |
CVE-2023-47204 | Critical | 9.8 | 2023-11-02 | Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. |
CVE-2023-1714 | High | 8.8 | 2023-11-01 | Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitr… |
CVE-2023-47174 | Critical | 9.8 | 2023-10-31 | Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related is… |
CVE-2023-45672 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used… |
CVE-2023-5583 | High | 8.8 | 2023-10-30 | The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted inpu… |
CVE-2023-40121 | Medium | 5.5 | 2023-10-27 | In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosu… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-43208 | Critical | 9.8 | 2023-10-26 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the inc… |
CVE-2023-4386 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2022-3342 | High | 7.5 | 2023-10-20 | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' functio… |
CVE-2023-4402 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2023-39680 | High | 7.5 | 2023-10-20 | Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. |
CVE-2023-34052 | High | 7.8 | 2023-10-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the… |
CVE-2023-35186 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2023-35184 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a Solar… |
CVE-2023-35182 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on Solar… |
CVE-2023-35180 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds… |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2023-45146 | Critical | 9.0 | 2023-10-18 | XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism… |
CVE-2023-35084 | Critical | 9.8 | 2023-10-18 | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which co… |
CVE-2023-4971 | High | 7.2 | 2023-10-16 | The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues wh… |
CVE-2023-23930 | Medium | 5.5 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serializatio… |
CVE-2023-44392 | High | 8.2 | 2023-10-09 | Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is… |
CVE-2023-26153 | High | 8.3 | 2023-10-06 | Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. T… |
CVE-2023-43981 | Critical | 9.8 | 2023-10-05 | Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php. |
CVE-2023-42809 | Critical | 9.6 | 2023-10-04 | Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java object… |
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2023-43176 | High | 8.8 | 2023-10-03 | A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file. |
CVE-2023-43268 | High | 8.8 | 2023-10-02 | Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability. |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-44273 | Critical | 9.8 | 2023-09-28 | Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the… |
CVE-2023-5183 | Critical | 9.9 | 2023-09-27 | Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to e… |
CVE-2023-43291 | Critical | 9.8 | 2023-09-27 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. |
CVE-2023-40044 | Critical | 10.0 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer mod… |
CVE-2023-40619 | Critical | 9.8 | 2023-09-20 | phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is direct… |
CVE-2023-5016 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnect… |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-38204 | Critical | 9.8 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilit… |
CVE-2023-38155 | High | 7.0 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-36777 | Medium | 5.7 | 2023-09-12 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2023-36757 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36756 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36745 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36744 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36736 | Medium | 4.4 | 2023-09-12 | Microsoft Identity Linux Broker Remote Code Execution Vulnerability |
CVE-2023-35669 | High | 7.8 | 2023-09-11 | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. Th… |
CVE-2022-1415 | High | 8.1 | 2023-09-11 | A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to… |
CVE-2020-19559 | Critical | 9.8 | 2023-09-11 | An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary code via a crafted payload to the ResolveMethod() parameter. |
CVE-2023-4528 | High | 7.2 | 2023-09-07 | Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS… |
CVE-2023-41330 | Critical | 9.8 | 2023-09-06 | knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issue On March 17th the vulnerability CVE-202… |
CVE-2023-0925 | Critical | 9.8 | 2023-09-06 | Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default)… |
CVE-2023-37941 | Medium | 6.6 | 2023-09-06 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote cod… |
CVE-2023-30534 | Medium | 4.3 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. Whi… |
CVE-2023-28072 | High | 7.8 | 2023-09-04 | Dell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of untrusted data vulnerability. A local malicious user could potentially… |
CVE-2023-40595 | High | 8.8 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrus… |
CVE-2023-40195 | High | 8.8 | 2023-08-28 | Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Pr… |
CVE-2023-40571 | Critical | 9.8 | 2023-08-25 | weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deseriali… |
CVE-2023-24621 | High | 7.8 | 2023-08-25 | An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are contro… |
CVE-2023-34040 | Medium | 5.3 | 2023-08-24 | In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configurati… |
CVE-2023-39106 | High | 8.8 | 2023-08-21 | An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component. |
CVE-2023-3259 | Critical | 9.8 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "… |
CVE-2023-39396 | High | 7.5 | 2023-08-13 | Deserialization vulnerability in the input module. Successful exploitation of this vulnerability may affect availability. |