CWE-502 · Deserialization of Untrusted Data (page 25)
Page 25 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37936 | Critical | 9.8 | 2023-03-01 | Unauthenticated Java deserialization vulnerability in Serviceguard Manager |
CVE-2023-27372 | Critical | 9.8 | 2023-02-28 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4… |
CVE-2023-20944 | High | 7.8 | 2023-02-28 | In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of… |
CVE-2022-23535 | High | 7.3 | 2023-02-24 | LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a… |
CVE-2023-26326 | Critical | 9.8 | 2023-02-23 | The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker cou… |
CVE-2023-0960 | Medium | 4.7 | 2023-02-22 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php o… |
CVE-2022-48282 | Medium | 6.6 | 2023-02-21 | Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause… |
CVE-2023-26234 | Medium | 6.6 | 2023-02-21 | JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance. |
CVE-2022-47986 | Critical | 9.8 | 2023-02-17 | IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw… |
CVE-2023-23836 | High | 7.2 | 2023-02-15 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Or… |
CVE-2022-47507 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-47504 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-47503 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-38111 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2023-21713 | High | 8.8 | 2023-02-14 | Microsoft SQL Server Remote Code Execution Vulnerability |
CVE-2023-21710 | High | 7.2 | 2023-02-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-21707 | High | 8.8 | 2023-02-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-21706 | High | 8.8 | 2023-02-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-21703 | Medium | 6.5 | 2023-02-14 | Azure Data Box Gateway Remote Code Execution Vulnerability |
CVE-2023-21568 | High | 7.3 | 2023-02-14 | Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability |
CVE-2023-21529 | High | 8.8 | 2023-02-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-25558 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processin… |
CVE-2022-3568 | High | 8.8 | 2023-02-10 | The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1… |
CVE-2022-45982 | Critical | 9.8 | 2023-02-08 | thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted pay… |
CVE-2023-25194 | High | 8.8 | 2023-02-07 | A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/mo… |
CVE-2023-0669 | High | 7.2 | 2023-02-06 | Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserial… |
CVE-2023-25135 | Critical | 9.8 | 2023-02-03 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This o… |
CVE-2023-24997 | Critical | 9.8 | 2023-02-01 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users a… |
CVE-2023-24162 | Critical | 9.8 | 2023-01-31 | Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. |
CVE-2022-44645 | High | 8.8 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-32521 | High | 7.1 | 2023-01-30 | A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data i… |
CVE-2022-31710 | High | 7.5 | 2023-01-26 | vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data wh… |
CVE-2022-45923 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increas… |
CVE-2023-21839 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2022-4890 | Medium | 6.3 | 2023-01-16 | A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/ini… |
CVE-2023-22850 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. |
CVE-2022-46478 | Critical | 9.8 | 2023-01-13 | The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via cr… |
CVE-2022-41778 | Critical | 9.8 | 2023-01-13 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port wi… |
CVE-2023-21779 | High | 7.8 | 2023-01-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-21762 | High | 8.0 | 2023-01-10 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-21745 | High | 8.0 | 2023-01-10 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-21744 | High | 8.8 | 2023-01-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-21538 | High | 7.5 | 2023-01-10 | .NET Denial of Service Vulnerability |
CVE-2022-47083 | High | 8.8 | 2023-01-10 | A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary code via sending c… |
CVE-2021-32828 | Medium | 5.4 | 2023-01-05 | The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable t… |
CVE-2021-32824 | Critical | 9.8 | 2023-01-03 | Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bea… |
CVE-2022-41966 | High | 8.2 | 2022-12-28 | XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow… |
CVE-2020-10650 | High | 8.1 | 2022-12-26 | A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or… |
CVE-2022-41596 | High | 7.5 | 2022-12-20 | The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components. |
CVE-2021-38241 | Critical | 9.8 | 2022-12-16 | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework. |
CVE-2021-33420 | Critical | 9.8 | 2022-12-15 | A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in Typed… |
CVE-2022-44351 | Critical | 9.8 | 2022-12-07 | Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php. |
CVE-2022-44371 | Critical | 9.8 | 2022-12-07 | hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE). |
CVE-2022-32224 | Critical | 9.8 | 2022-12-05 | A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could al… |
CVE-2022-46366 | Critical | 9.8 | 2022-12-02 | Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, whic… |
CVE-2022-1471 | High | 8.3 | 2022-12-01 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker ca… |
CVE-2022-36964 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |
CVE-2022-41958 | High | 7.3 | 2022-11-25 | super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker… |
CVE-2022-41875 | Critical | 10.0 | 2022-11-23 | A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially… |
CVE-2022-41922 | High | 8.1 | 2022-11-23 | `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has be… |
CVE-2022-3861 | High | 8.8 | 2022-11-21 | The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplie… |
CVE-2022-3525 | High | 8.8 | 2022-11-20 | Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-45077 | Medium | 6.3 | 2022-11-17 | Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress. |
CVE-2022-45047 | Critical | 9.8 | 2022-11-16 | Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.securi… |
CVE-2022-45136 | Critical | 9.8 | 2022-11-14 | Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying… |
CVE-2022-38652 | Critical | 9.9 | 2022-11-12 | A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated use… |
CVE-2022-38650 | Critical | 10.0 | 2022-11-12 | A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious p… |
CVE-2022-44562 | Critical | 9.8 | 2022-11-09 | The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege esc… |
CVE-2022-44559 | Critical | 9.8 | 2022-11-09 | The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-44558 | Critical | 9.8 | 2022-11-09 | The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-41203 | High | 8.8 | 2022-11-08 | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept… |
CVE-2022-32601 | High | 7.8 | 2022-11-08 | In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-31199 | Critical | 9.8 | 2022-11-08 | Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents… |
CVE-2022-3536 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path give… |
CVE-2022-42919 | High | 7.8 | 2022-11-07 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing libra… |
CVE-2022-43567 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of spe… |
CVE-2022-39379 | Low | 3.1 | 2022-11-02 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerabi… |
CVE-2022-44542 | Critical | 9.8 | 2022-11-01 | lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via a key/value pair i… |
CVE-2022-41779 | High | 8.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an… |
CVE-2022-38142 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port withou… |
CVE-2022-3380 | High | 7.2 | 2022-10-31 | The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when a… |
CVE-2022-3374 | High | 7.2 | 2022-10-31 | The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privil… |
CVE-2022-3366 | High | 7.2 | 2022-10-31 | The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported f… |
CVE-2022-3360 | High | 8.1 | 2022-10-31 | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Objec… |
CVE-2022-3357 | High | 8.8 | 2022-10-31 | The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user i… |
CVE-2022-3334 | High | 7.2 | 2022-10-31 | The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin impor… |
CVE-2022-40238 | High | 8.8 | 2022-10-26 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-3335 | High | 7.2 | 2022-10-25 | The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections is… |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-38108 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-36958 | High | 8.8 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |
CVE-2022-36957 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-43019 | Critical | 9.8 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. |
CVE-2022-23734 | High | 8.8 | 2022-10-19 | A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBri… |
CVE-2022-21624 | Low | 3.7 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Or… |
CVE-2022-39198 | Critical | 9.8 | 2022-10-18 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects… |
CVE-2022-40889 | Critical | 9.8 | 2022-10-18 | Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php. |
CVE-2022-22241 | High | 8.1 | 2022-10-18 | An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without pro… |
CVE-2022-3291 | Medium | 6.5 | 2022-10-17 | Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitiv… |