CWE-502 · Deserialization of Untrusted Data (page 27)

Page 27 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-502 — newest first (page 27 of 31)
CVESeverityScorePublishedSummary
CVE-2014-1420Low3.82020-09-11On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver woul…
CVE-2020-24034High8.82020-09-01Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation t…
CVE-2020-17405High8.82020-09-01This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not req…
CVE-2020-15777High7.82020-08-25An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects…
CVE-2020-24616High8.12020-08-25FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPD…
CVE-2020-10289High8.82020-08-20Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an act…
CVE-2020-4589Critical9.82020-08-13IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence…
CVE-2020-5413Critical9.82020-07-31Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, al…
CVE-2019-11286Critical9.12020-07-31VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain…
CVE-2020-15098High8.82020-07-29In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte…
CVE-2020-15086Critical9.82020-07-29In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism…
CVE-2020-10917Critical9.82020-07-22This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to ex…
CVE-2020-9664Critical9.82020-07-22Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code…
CVE-2020-15842High8.12020-07-20Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to e…
CVE-2020-4464High8.82020-07-17IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafte…
CVE-2020-11982Critical9.82020-07-17An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly…
CVE-2020-12015High7.52020-07-16A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue aff…
CVE-2020-12007Critical9.82020-07-16A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserializat…
CVE-2020-12009High7.52020-07-16A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This aff…
CVE-2020-14000Critical9.82020-07-16MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ chara…
CVE-2020-9496Medium6.12020-07-15XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
CVE-2020-1439High8.82020-07-14A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file…
CVE-2020-1948Critical9.82020-07-14This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name a…
CVE-2020-4305High8.82020-07-09IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of…
CVE-2020-14172Critical9.82020-07-03This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in w…
CVE-2020-2211High8.82020-07-02Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultin…
CVE-2013-7489Medium6.82020-06-26The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.
CVE-2020-10740Medium6.62020-06-22A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB…
CVE-2020-14942Critical9.82020-06-21Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
CVE-2020-14933High8.82020-06-20compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this bec…
CVE-2020-14932Critical9.82020-06-20compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
CVE-2020-8165Critical9.82020-06-19A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects i…
CVE-2020-8164High7.52020-06-19A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadverte…
CVE-2020-14195High8.12020-06-16FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRea…
CVE-2020-14060High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JN…
CVE-2020-14062High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.interna…
CVE-2020-14061High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionF…
CVE-2020-5411High8.12020-06-11When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vul…
CVE-2020-0132Medium5.52020-06-11In BnAAudioService::onTransact of IAAudioService.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local informatio…
CVE-2020-4043High7.72020-06-10phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected…
CVE-2020-12000High7.52020-06-09The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can re…
CVE-2020-10644High7.52020-06-09The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions p…
CVE-2020-4450Critical9.82020-06-05IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequenc…
CVE-2020-4449High7.52020-06-05IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequ…
CVE-2020-4448Critical9.82020-06-05IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special…
CVE-2020-7660High8.12020-06-01serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
CVE-2020-12390Critical9.82020-05-26Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.
CVE-2020-3280Critical9.82020-05-22A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker t…
CVE-2018-21234Critical9.82020-05-21Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2020-9484High7.02020-05-20When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con…
CVE-2020-12835Critical9.82020-05-20An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inj…
CVE-2020-13092Critical9.82020-05-15scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce…
CVE-2020-13091Critical9.82020-05-15pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system…
CVE-2020-11973Critical9.82020-05-14Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgra…
CVE-2020-11972Critical9.82020-05-14Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should up…
CVE-2020-11067High8.82020-05-14In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure des…
CVE-2019-16112High8.82020-05-13TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?servic…
CVE-2020-12760High8.82020-05-11An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed fo…
CVE-2020-5741High7.22020-05-08Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
CVE-2020-2189High8.82020-05-06Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote co…
CVE-2020-12471Critical9.82020-04-29MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx because of deserialization in…
CVE-2020-12469Medium6.52020-04-29admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a blo…
CVE-2020-12133Critical9.82020-04-27The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserializa…
CVE-2020-10915Critical9.82020-04-22This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…
CVE-2020-10914Critical9.82020-04-22This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…
CVE-2020-0082High7.82020-04-17In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local e…
CVE-2020-2180High8.82020-04-16Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi…
CVE-2020-2179High8.82020-04-16Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execu…
CVE-2020-1964Critical9.82020-04-16It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent th…
CVE-2020-4272High8.82020-04-15IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted request specify a…
CVE-2020-4271Medium6.32020-04-15IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be executed as a lower privileged user. IBM…
CVE-2020-2757Low3.72020-04-15Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8…
CVE-2020-2756Low3.72020-04-15Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8…
CVE-2020-6219High8.82020-04-14SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta…
CVE-2020-11630Critical9.82020-04-08An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes…
CVE-2020-11620High8.12020-04-07FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Em…
CVE-2020-11619High8.12020-04-07FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.M…
CVE-2019-17564Critical9.82020-04-01Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to com…
CVE-2020-11467High7.22020-04-01An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-them…
CVE-2019-2391Medium4.22020-03-31Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data di…
CVE-2020-11113High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistr…
CVE-2020-11112High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provide…
CVE-2020-11111High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activ…
CVE-2020-7610Critical9.82020-03-30All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leadi…
CVE-2020-10969High8.82020-03-26FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968High8.82020-03-26FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remo…
CVE-2020-6967Critical9.82020-03-23In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .N…
CVE-2020-7961Critical9.82020-03-20Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
CVE-2020-10673High8.82020-03-18FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.Resource…
CVE-2020-10672High8.82020-03-18FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms…
CVE-2019-20453High8.82020-03-17A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownl…
CVE-2019-20452High8.82020-03-17A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/Recycle…
CVE-2020-1947Critical9.82020-03-11In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource…
CVE-2017-10992Critical9.82020-03-10In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvoke…
CVE-2016-1487High8.82020-03-09Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization.
CVE-2020-2158High8.82020-03-09Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio…
CVE-2020-5327High8.12020-03-06Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the…
CVE-2020-10189Critical9.82020-03-06Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage…
CVE-2019-14893Critical9.82020-03-02A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious ob…
CVE-2019-14892Critical9.82020-03-02A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious obj…