CWE-502 · Deserialization of Untrusted Data (page 24)
Page 24 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29936 | High | 8.8 | 2022-04-29 | USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java d… |
CVE-2022-29528 | Critical | 9.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. |
CVE-2022-26133 | Critical | 9.8 | 2022-04-20 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later… |
CVE-2022-21445 | Critical | 9.8 | 2022-04-19 | Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are af… |
CVE-2022-27158 | Critical | 9.8 | 2022-04-15 | pearweb < 1.32 suffers from Deserialization of Untrusted Data. |
CVE-2022-24846 | Critical | 9.1 | 2022-04-14 | GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used… |
CVE-2021-21956 | High | 7.8 | 2022-04-14 | A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potent… |
CVE-2022-22958 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22957 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2019-6834 | High | 7.3 | 2022-04-13 | A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM pr… |
CVE-2022-23450 | Critical | 9.8 | 2022-04-12 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1)… |
CVE-2022-20763 | Medium | 5.4 | 2022-04-06 | A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This… |
CVE-2020-19229 | Critical | 9.8 | 2022-04-05 | Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker cou… |
CVE-2021-33207 | Critical | 9.8 | 2022-04-05 | The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. |
CVE-2022-1032 | High | 7.2 | 2022-03-29 | Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6. |
CVE-2021-27475 | High | 8.6 | 2022-03-23 | Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers… |
CVE-2021-27470 | Critical | 10.0 | 2022-03-23 | A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized… |
CVE-2021-27466 | Critical | 10.0 | 2022-03-23 | A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies seriali… |
CVE-2021-27462 | Critical | 10.0 | 2022-03-23 | A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized… |
CVE-2021-27460 | Critical | 10.0 | 2022-03-23 | Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently… |
CVE-2022-26503 | High | 7.8 | 2022-03-17 | Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system priv… |
CVE-2022-0749 | High | 7.4 | 2022-03-17 | This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has b… |
CVE-2022-23940 | High | 8.8 | 2022-03-10 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by… |
CVE-2022-24282 | High | 7.2 | 2022-03-08 | A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affe… |
CVE-2022-21828 | High | 7.2 | 2022-03-04 | A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vec… |
CVE-2022-0138 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserial… |
CVE-2021-46364 | High | 7.8 | 2022-02-11 | A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file. |
CVE-2022-24289 | High | 8.8 | 2022-02-11 | Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web… |
CVE-2022-22005 | High | 8.8 | 2022-02-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-0538 | High | 7.5 | 2022-02-09 | Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability… |
CVE-2021-42631 | High | 8.1 | 2022-01-31 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution. |
CVE-2021-45899 | Critical | 9.8 | 2022-01-28 | SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution. |
CVE-2021-41766 | High | 8.1 | 2022-01-26 | Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that reli… |
CVE-2022-21341 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affect… |
CVE-2022-23307 | High | 8.8 | 2022-01-18 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x whe… |
CVE-2022-23302 | High | 8.8 | 2022-01-18 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the… |
CVE-2021-45394 | High | 8.8 | 2022-01-18 | An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in… |
CVE-2021-43297 | Critical | 9.8 | 2022-01-10 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users u… |
CVE-2021-42392 | Critical | 9.8 | 2022-01-10 | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pas… |
CVE-2022-21663 | Medium | 6.6 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role ca… |
CVE-2022-21647 | High | 7.7 | 2022-01-04 | CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attacke… |
CVE-2021-20318 | High | 7.2 | 2021-12-23 | The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with… |
CVE-2021-4118 | High | 7.8 | 2021-12-23 | pytorch-lightning is vulnerable to Deserialization of Untrusted Data |
CVE-2021-43853 | High | 8.7 | 2021-12-22 | Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object inj… |
CVE-2021-44029 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization explo… |
CVE-2021-36336 | Critical | 9.8 | 2021-12-21 | Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affe… |
CVE-2021-42550 | Medium | 6.6 | 2021-12-16 | In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowi… |
CVE-2021-0970 | High | 7.8 | 2021-12-15 | In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of pri… |
CVE-2021-4104 | High | 7.5 | 2021-12-14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can pro… |
CVE-2021-24857 | Critical | 9.8 | 2021-12-13 | The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a… |
CVE-2021-44228 | Critical | 10.0 | 2021-12-10 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter… |
CVE-2021-42130 | High | 8.8 | 2021-12-07 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arb… |
CVE-2021-42127 | Critical | 9.8 | 2021-12-07 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repos… |
CVE-2021-42125 | High | 8.8 | 2021-12-07 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous fil… |
CVE-2021-44682 | Critical | 9.8 | 2021-12-06 | An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44681 | Critical | 9.8 | 2021-12-06 | An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44680 | Critical | 9.8 | 2021-12-06 | An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44679 | Critical | 9.8 | 2021-12-06 | An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44678 | Critical | 9.8 | 2021-12-06 | An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-44677 | Critical | 9.8 | 2021-12-06 | An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen… |
CVE-2021-36567 | Critical | 9.8 | 2021-12-06 | ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. |
CVE-2021-36564 | Critical | 9.8 | 2021-12-06 | ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php. |
CVE-2021-23758 | High | 8.1 | 2021-12-03 | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, whic… |
CVE-2021-43360 | High | 8.8 | 2021-12-01 | Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated re… |
CVE-2021-22095 | Medium | 6.5 | 2021-11-30 | In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the m… |
CVE-2021-34992 | High | 8.8 | 2021-11-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit… |
CVE-2021-26558 | High | 7.5 | 2021-11-11 | Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache Shardi… |
CVE-2021-42698 | High | 7.8 | 2021-11-05 | Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects… |
CVE-2021-42237 | Critical | 9.8 | 2021-11-05 | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command… |
CVE-2021-22097 | Medium | 6.5 | 2021-10-28 | In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with… |
CVE-2019-19810 | Critical | 10.0 | 2021-10-28 | Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthenticated attacker can ex… |
CVE-2021-41078 | High | 7.8 | 2021-10-26 | Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. |
CVE-2021-40865 | Critical | 9.8 | 2021-10-25 | An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apac… |
CVE-2021-40719 | Critical | 9.8 | 2021-10-21 | Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF mes… |
CVE-2021-39321 | High | 8.8 | 2021-10-21 | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to de… |
CVE-2021-35227 | Medium | 4.7 | 2021-10-21 | The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. |
CVE-2021-40720 | Critical | 9.8 | 2021-10-15 | Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo… |
CVE-2021-40843 | High | 7.3 | 2021-10-13 | Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local dat… |
CVE-2021-33728 | High | 7.2 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to… |
CVE-2021-25738 | Medium | 6.7 | 2021-10-11 | Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. |
CVE-2021-42090 | Critical | 9.8 | 2021-10-07 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-0685 | High | 7.8 | 2021-10-06 | In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead… |
CVE-2021-41110 | Critical | 9.1 | 2021-10-01 | cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulner… |
CVE-2021-41616 | Critical | 9.8 | 2021-09-30 | Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVAR… |
CVE-2021-41588 | High | 8.1 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and… |
CVE-2021-40102 | Critical | 9.1 | 2021-09-24 | An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated wi… |
CVE-2021-31819 | Critical | 9.8 | 2021-09-22 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other bas… |
CVE-2021-39392 | Critical | 9.8 | 2021-09-15 | The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for a… |
CVE-2021-37181 | Critical | 10.0 | 2021-09-14 | A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0… |
CVE-2021-39207 | High | 8.4 | 2021-09-10 | parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable… |
CVE-2021-24040 | Critical | 9.8 | 2021-09-10 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting… |
CVE-2021-37579 | Critical | 9.8 | 2021-09-09 | The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there… |
CVE-2021-32836 | High | 7.5 | 2021-09-09 | ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulner… |
CVE-2021-35217 | High | 8.9 | 2021-09-08 | Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to… |
CVE-2021-36163 | Critical | 9.8 | 2021-09-07 | In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directl… |
CVE-2021-32568 | High | 7.8 | 2021-09-06 | mrdoc is vulnerable to Deserialization of Untrusted Data |
CVE-2021-35218 | High | 8.9 | 2021-09-01 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the O… |
CVE-2021-35216 | High | 8.9 | 2021-09-01 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authentica… |
CVE-2021-35215 | High | 8.9 | 2021-09-01 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulne… |