CWE-502 · Deserialization of Untrusted Data (page 24)
Page 24 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38182 | High | 8.0 | 2023-08-08 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-38181 | High | 8.8 | 2023-08-08 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-35388 | High | 8.0 | 2023-08-08 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-38689 | High | 8.1 | 2023-08-04 | Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted da… |
CVE-2023-36480 | Critical | 9.8 | 2023-08-04 | The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2… |
CVE-2022-40609 | High | 8.1 | 2023-08-02 | IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2021-31681 | High | 7.8 | 2023-07-31 | Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file. |
CVE-2021-31680 | High | 7.8 | 2023-07-31 | Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file. |
CVE-2023-24971 | High | 7.5 | 2023-07-31 | IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deseri… |
CVE-2023-38647 | Critical | 9.8 | 2023-07-26 | An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngin… |
CVE-2023-37895 | Critical | 9.8 | 2023-07-25 | Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2… |
CVE-2023-34434 | High | 7.5 | 2023-07-25 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The a… |
CVE-2023-3324 | Medium | 6.3 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-38203 | Critical | 9.8 | 2023-07-20 | Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilit… |
CVE-2023-28754 | High | 8.8 | 2023-07-19 | Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML… |
CVE-2023-26512 | Critical | 9.8 | 2023-07-17 | CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. p… |
CVE-2023-3513 | High | 7.8 | 2023-07-14 | Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain S… |
CVE-2023-25770 | Critical | 9.8 | 2023-07-13 | Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for… |
CVE-2023-3343 | High | 8.8 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input… |
CVE-2023-29300 | Critical | 9.8 | 2023-07-12 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vul… |
CVE-2023-36825 | Critical | 9.6 | 2023-07-11 | Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present startin… |
CVE-2023-35317 | High | 7.8 | 2023-07-11 | Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability |
CVE-2023-33160 | High | 8.8 | 2023-07-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-33134 | High | 8.8 | 2023-07-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-34347 | Critical | 9.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely ex… |
CVE-2023-33008 | Medium | 5.3 | 2023-07-07 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses lar… |
CVE-2023-28323 | Critical | 9.8 | 2023-07-01 | A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could pot… |
CVE-2023-31222 | Critical | 9.8 | 2023-06-29 | Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthori… |
CVE-2023-21209 | Medium | 6.7 | 2023-06-28 | In multiple functions of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local escalation of privilege… |
CVE-2023-21206 | Medium | 4.4 | 2023-06-28 | In initiateVenueUrlAnqpQueryInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local informati… |
CVE-2023-21205 | Medium | 5.5 | 2023-06-28 | In startWpsPinDisplayInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local information disc… |
CVE-2023-33299 | Critical | 9.8 | 2023-06-23 | A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unaut… |
CVE-2023-26436 | High | 7.1 | 2023-06-20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Acce… |
CVE-2023-35839 | Critical | 9.8 | 2023-06-19 | A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload. |
CVE-2023-3308 | Medium | 5.5 | 2023-06-18 | A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. Th… |
CVE-2023-21124 | High | 7.8 | 2023-06-15 | In run of multiple files, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no a… |
CVE-2023-32031 | High | 8.8 | 2023-06-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-28310 | High | 8.0 | 2023-06-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-3001 | High | 7.8 | 2023-06-14 | A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potent… |
CVE-2023-3234 | Medium | 4.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the… |
CVE-2023-3232 | Medium | 6.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_au… |
CVE-2023-34212 | Medium | 6.5 | 2023-06-12 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an auth… |
CVE-2023-30262 | High | 8.8 | 2023-06-09 | An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execu… |
CVE-2023-33496 | Critical | 9.8 | 2023-06-07 | xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode. |
CVE-2023-33284 | High | 8.8 | 2023-06-07 | Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in con… |
CVE-2023-20888 | High | 8.8 | 2023-06-07 | Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Netwo… |
CVE-2020-36727 | Critical | 9.8 | 2023-06-07 | The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input… |
CVE-2020-36726 | Critical | 9.8 | 2023-06-07 | The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input… |
CVE-2020-36718 | Critical | 9.8 | 2023-06-07 | The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrus… |
CVE-2023-33963 | Critical | 9.8 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, wh… |
CVE-2023-2288 | High | 8.8 | 2023-05-30 | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deser… |
CVE-2023-2500 | High | 8.8 | 2023-05-25 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via de… |
CVE-2022-4815 | High | 8.0 | 2023-05-24 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining th… |
CVE-2023-27068 | Critical | 9.8 | 2023-05-23 | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. |
CVE-2023-31058 | High | 7.5 | 2023-05-22 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attacke… |
CVE-2023-32336 | High | 8.8 | 2023-05-22 | IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. IBM X-Force ID… |
CVE-2023-31890 | Critical | 9.8 | 2023-05-16 | An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter. |
CVE-2023-20878 | High | 7.2 | 2023-05-12 | VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt th… |
CVE-2023-30899 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev1… |
CVE-2023-30898 | Critical | 9.9 | 2023-05-09 | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev1… |
CVE-2023-1650 | Critical | 9.8 | 2023-05-08 | The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them… |
CVE-2023-1347 | High | 7.2 | 2023-05-08 | The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as ad… |
CVE-2023-1196 | High | 8.8 | 2023-05-02 | The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow us… |
CVE-2023-1669 | High | 7.2 | 2023-05-02 | The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform… |
CVE-2023-1967 | Critical | 9.8 | 2023-04-27 | Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid. |
CVE-2023-20853 | Critical | 9.8 | 2023-04-27 | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote atta… |
CVE-2023-20852 | Critical | 9.8 | 2023-04-27 | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit t… |
CVE-2023-2141 | High | 8.5 | 2023-04-21 | An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution. |
CVE-2023-20864 | Critical | 9.8 | 2023-04-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for… |
CVE-2021-28254 | Critical | 9.8 | 2023-04-19 | A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. |
CVE-2023-2042 | Medium | 6.3 | 2023-04-14 | A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown functionality of the… |
CVE-2023-1552 | Medium | 6.4 | 2023-04-11 | ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineeri… |
CVE-2023-1381 | High | 8.8 | 2023-04-10 | The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserializa… |
CVE-2023-29216 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a… |
CVE-2023-29215 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Mod… |
CVE-2023-28500 | Critical | 9.8 | 2023-04-06 | A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system… |
CVE-2023-20102 | High | 8.8 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker to execute arbitrary code… |
CVE-2023-29006 | High | 8.8 | 2023-04-05 | The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated… |
CVE-2020-29312 | Critical | 9.8 | 2023-04-04 | An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been dispute… |
CVE-2023-28462 | Critical | 9.8 | 2023-03-30 | A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community)… |
CVE-2022-36978 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36977 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36974 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36971 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-2561 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of OPC Labs QuickOPC 2022.1. User interaction is required to exp… |
CVE-2022-28685 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2023-26548 | High | 7.5 | 2023-03-27 | The pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-26547 | High | 7.8 | 2023-03-27 | The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalat… |
CVE-2023-1399 | High | 7.8 | 2023-03-27 | N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the aff… |
CVE-2023-27296 | High | 8.8 | 2023-03-27 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could… |
CVE-2023-1145 | High | 7.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect serv… |
CVE-2023-1139 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which… |
CVE-2023-1133 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by def… |
CVE-2023-26359 | Critical | 9.8 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that c… |
CVE-2023-28667 | Critical | 9.8 | 2023-03-22 | The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_ap… |
CVE-2023-27978 | High | 7.8 | 2023-03-21 | A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potenti… |
CVE-2023-28115 | Critical | 9.8 | 2023-03-17 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserial… |
CVE-2023-26464 | High | 7.5 | 2023-03-10 | ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a… |
CVE-2023-23638 | Medium | 5.0 | 2023-03-08 | A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x versio… |
CVE-2023-26779 | Critical | 9.8 | 2023-03-03 | CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE). |