CWE-502 · Deserialization of Untrusted Data (page 26)
Page 26 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21344 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21342 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21341 | High | 7.5 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacke… |
CVE-2021-26295 | Critical | 9.8 | 2021-03-22 | Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. |
CVE-2020-36282 | Critical | 9.8 | 2021-03-12 | JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMess… |
CVE-2020-29045 | Critical | 9.8 | 2021-03-11 | The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_car… |
CVE-2021-21371 | Medium | 5.0 | 2021-03-10 | Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabil… |
CVE-2021-21488 | Medium | 6.5 | 2021-03-09 | Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without ver… |
CVE-2020-24914 | Critical | 9.8 | 2021-03-04 | A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and al… |
CVE-2020-24036 | High | 8.8 | 2021-03-04 | PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code. |
CVE-2020-29047 | Critical | 9.8 | 2021-03-03 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress… |
CVE-2021-20076 | High | 8.8 | 2021-03-03 | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to per… |
CVE-2021-26857 | High | 7.8 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-24066 | High | 8.8 | 2021-02-25 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2021-27335 | Critical | 9.8 | 2021-02-18 | KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter. |
CVE-2021-22855 | Critical | 9.8 | 2021-02-17 | The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execu… |
CVE-2021-23338 | Medium | 6.6 | 2021-02-15 | This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. |
CVE-2021-27213 | Critical | 9.8 | 2021-02-14 | config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used. |
CVE-2020-27868 | Critical | 9.8 | 2021-02-12 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to… |
CVE-2021-26915 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26914 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26913 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-26912 | High | 8.1 | 2021-02-08 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserializati… |
CVE-2021-25274 | Critical | 9.8 | 2021-02-03 | The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a… |
CVE-2021-25758 | High | 7.8 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. |
CVE-2021-3160 | Critical | 9.8 | 2021-01-28 | Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unse… |
CVE-2020-4888 | High | 8.8 | 2021-01-28 | IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure… |
CVE-2020-4682 | Critical | 9.8 | 2021-01-28 | IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of tr… |
CVE-2020-27583 | Critical | 9.8 | 2021-01-26 | IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote unauthenticated attackers to execute arbitr… |
CVE-2020-17532 | High | 8.8 | 2021-01-25 | When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem h… |
CVE-2020-12525 | High | 7.3 | 2021-01-22 | M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its pro… |
CVE-2021-20190 | High | 8.1 | 2021-01-19 | A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from th… |
CVE-2021-25294 | Critical | 9.8 | 2021-01-18 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unse… |
CVE-2021-21249 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execu… |
CVE-2021-21247 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior… |
CVE-2021-21242 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. At… |
CVE-2021-21243 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from th… |
CVE-2020-24639 | Critical | 9.8 | 2021-01-15 | There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass… |
CVE-2020-23653 | Critical | 9.8 | 2021-01-13 | An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/ap… |
CVE-2021-21604 | High | 8.0 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old D… |
CVE-2020-26118 | High | 8.8 | 2021-01-11 | In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerabilit… |
CVE-2020-11995 | Critical | 9.8 | 2021-01-11 | A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as… |
CVE-2020-36183 | High | 8.1 | 2021-01-07 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib… |
CVE-2020-36182 | High | 8.1 | 2021-01-07 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpd… |
CVE-2020-36180 | High | 8.1 | 2021-01-07 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsada… |
CVE-2020-36179 | High | 8.1 | 2021-01-07 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpd… |
CVE-2020-36189 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.l… |
CVE-2020-36188 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.l… |
CVE-2020-36187 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.data… |
CVE-2020-36186 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.data… |
CVE-2020-36185 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.dat… |
CVE-2020-36184 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.dat… |
CVE-2020-36181 | High | 8.1 | 2021-01-06 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpds… |
CVE-2020-8884 | High | 8.8 | 2021-01-06 | rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arb… |
CVE-2020-10658 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage AP… |
CVE-2020-10657 | High | 7.2 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules fea… |
CVE-2020-10656 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2020-10655 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2020-35488 | High | 7.5 | 2021-01-05 | The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted S… |
CVE-2019-4728 | High | 8.8 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary… |
CVE-2021-3007 | Critical | 9.8 | 2021-01-04 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content… |
CVE-2020-35939 | High | 7.5 | 2021-01-01 | PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP obje… |
CVE-2020-35938 | High | 7.5 | 2021-01-01 | PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects d… |
CVE-2020-35932 | High | 7.5 | 2021-01-01 | Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers… |
CVE-2020-26165 | High | 8.8 | 2020-12-31 | qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unseri… |
CVE-2019-7725 | Critical | 9.8 | 2020-12-31 | includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSO… |
CVE-2020-35728 | High | 8.1 | 2020-12-27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache… |
CVE-2020-35491 | High | 8.1 | 2020-12-17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasou… |
CVE-2020-35490 | High | 8.1 | 2020-12-17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasou… |
CVE-2020-22083 | Critical | 9.8 | 2020-12-17 | jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued tha… |
CVE-2020-20136 | Critical | 9.8 | 2020-12-14 | QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling… |
CVE-2020-9301 | High | 8.8 | 2020-12-11 | Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnera… |
CVE-2020-17144 | High | 8.4 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17531 | Critical | 9.8 | 2020-12-08 | A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the pa… |
CVE-2020-28948 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. |
CVE-2020-27131 | High | 8.1 | 2020-11-17 | Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute… |
CVE-2020-5664 | Critical | 9.8 | 2020-11-16 | Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2020-28339 | High | 7.5 | 2020-11-07 | The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete… |
CVE-2020-26207 | High | 8.0 | 2020-11-04 | DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted `.dbschema` file. T… |
CVE-2020-28032 | Critical | 9.8 | 2020-11-02 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. |
CVE-2020-10721 | High | 7.8 | 2020-10-22 | A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file… |
CVE-2020-15244 | High | 8.0 | 2020-10-21 | In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger R… |
CVE-2020-24648 | Critical | 9.8 | 2020-10-19 | A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) ve… |
CVE-2020-7811 | Medium | 6.2 | 2020-10-12 | Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializ… |
CVE-2020-26867 | Critical | 9.8 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arb… |
CVE-2020-26945 | High | 8.1 | 2020-10-10 | MyBatis before 3.5.6 mishandles deserialization of object streams. |
CVE-2020-4280 | High | 8.8 | 2020-10-08 | IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied cont… |
CVE-2020-14030 | High | 7.2 | 2020-09-30 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing… |
CVE-2020-15188 | Critical | 10.0 | 2020-09-18 | SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the in… |
CVE-2020-24750 | High | 8.1 | 2020-09-17 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.confi… |
CVE-2020-7532 | High | 7.8 | 2020-09-16 | A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could allow arbitrary code ex… |
CVE-2020-7528 | High | 7.8 | 2020-09-16 | A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code executi… |
CVE-2020-15172 | High | 8.7 | 2020-09-15 | The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted me… |
CVE-2020-15148 | High | 8.9 | 2020-09-15 | Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fix… |
CVE-2020-4521 | High | 8.8 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializ… |
CVE-2020-24164 | High | 7.8 | 2020-09-11 | A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, wh… |
CVE-2020-25260 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25259 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25258 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |