CWE-502 · Deserialization of Untrusted Data (page 28)
Page 28 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39149 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39148 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39147 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39146 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39145 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39144 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient righ… |
CVE-2021-39141 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-39139 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute… |
CVE-2021-21868 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21867 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-37678 | Critical | 9.3 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execu… |
CVE-2021-38585 | High | 7.2 | 2021-08-11 | The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). |
CVE-2021-23420 | High | 7.7 | 2021-08-11 | This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary… |
CVE-2021-37544 | Critical | 9.8 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. |
CVE-2021-37632 | High | 8.1 | 2021-08-05 | SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8… |
CVE-2021-34371 | Critical | 9.8 | 2021-08-05 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An at… |
CVE-2021-21863 | High | 7.8 | 2021-08-05 | A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5… |
CVE-2021-36483 | High | 8.8 | 2021-08-04 | DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. |
CVE-2021-21866 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21865 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21864 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development S… |
CVE-2021-36766 | High | 7.2 | 2021-07-30 | Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php… |
CVE-2021-29781 | Critical | 9.8 | 2021-07-30 | IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending… |
CVE-2021-37578 | Critical | 9.8 | 2021-07-29 | Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessin… |
CVE-2020-5341 | Critical | 9.8 | 2021-07-28 | Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protectio… |
CVE-2021-35464 | Critical | 9.8 | 2021-07-22 | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require… |
CVE-2021-22777 | High | 7.8 | 2021-07-21 | A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file. |
CVE-2021-34520 | High | 8.1 | 2021-07-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-32742 | High | 7.5 | 2021-07-09 | Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server me… |
CVE-2021-29150 | High | 7.2 | 2021-07-08 | A remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba has releas… |
CVE-2021-24384 | Critical | 9.8 | 2021-07-06 | The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised u… |
CVE-2021-35971 | Critical | 9.8 | 2021-06-30 | Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. |
CVE-2021-29485 | Critical | 9.9 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously… |
CVE-2021-22439 | High | 8.1 | 2021-06-29 | There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfu… |
CVE-2021-31649 | Critical | 9.8 | 2021-06-24 | In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute |
CVE-2021-34394 | Medium | 4.2 | 2021-06-22 | Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use th… |
CVE-2021-34393 | Medium | 4.2 | 2021-06-22 | Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability mig… |
CVE-2021-35196 | High | 7.8 | 2021-06-21 | Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure des… |
CVE-2020-9493 | Critical | 9.8 | 2021-06-16 | A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. |
CVE-2021-3040 | Medium | 6.7 | 2021-06-10 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-33176 | High | 7.5 | 2021-06-08 | VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of un… |
CVE-2021-33175 | High | 7.5 | 2021-06-08 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted… |
CVE-2021-33898 | High | 8.1 | 2021-06-06 | In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deseriali… |
CVE-2021-33806 | Critical | 9.8 | 2021-06-03 | The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as par… |
CVE-2021-23895 | Critical | 9.0 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse s… |
CVE-2021-23894 | Critical | 9.6 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse… |
CVE-2021-30179 | Critical | 9.8 | 2021-06-01 | Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by t… |
CVE-2021-25641 | Critical | 9.8 | 2021-06-01 | Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or… |
CVE-2021-33790 | Critical | 9.8 | 2021-05-31 | The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.c… |
CVE-2021-29505 | High | 7.5 | 2021-05-28 | XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has suf… |
CVE-2021-27852 | Critical | 9.8 | 2021-05-27 | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This… |
CVE-2021-32075 | Critical | 9.8 | 2021-05-24 | Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization. |
CVE-2021-24307 | High | 8.8 | 2021-05-24 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privi… |
CVE-2021-32634 | High | 7.2 | 2021-05-21 | Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests… |
CVE-2021-31474 | Critical | 9.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authenticati… |
CVE-2021-24280 | High | 8.8 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action… |
CVE-2021-33026 | Critical | 9.8 | 2021-05-13 | The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation… |
CVE-2021-29508 | Critical | 9.1 | 2021-05-11 | Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender… |
CVE-2021-32098 | Critical | 9.8 | 2021-05-07 | Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. |
CVE-2021-25152 | High | 7.2 | 2021-04-28 | A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches fo… |
CVE-2021-25151 | High | 8.8 | 2021-04-28 | A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches fo… |
CVE-2020-36326 | Critical | 9.8 | 2021-04-28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-192… |
CVE-2021-29476 | Critical | 9.8 | 2021-04-27 | Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1… |
CVE-2021-30128 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version |
CVE-2021-29200 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack |
CVE-2020-7385 | High | 8.1 | 2021-04-23 | By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploi… |
CVE-2021-27277 | High | 7.8 | 2021-04-22 | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attack… |
CVE-2021-3287 | Critical | 9.8 | 2021-04-22 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. |
CVE-2021-21426 | Critical | 9.8 | 2021-04-21 | Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vu… |
CVE-2021-3035 | Medium | 6.7 | 2021-04-20 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-27850 | Critical | 9.8 | 2021-04-15 | A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5… |
CVE-2021-29654 | High | 7.2 | 2021-04-14 | AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execu… |
CVE-2021-21524 | Critical | 9.8 | 2021-04-12 | Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker… |
CVE-2021-24217 | High | 8.1 | 2021-04-12 | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied cre… |
CVE-2021-1415 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-1414 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-1413 | Medium | 6.3 | 2021-04-08 | Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authentica… |
CVE-2021-27240 | High | 7.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain… |
CVE-2021-21351 | Medium | 5.4 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to… |
CVE-2021-21350 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21349 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21348 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21347 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21346 | Medium | 6.1 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21345 | Medium | 5.8 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21344 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21342 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2021-21341 | High | 7.5 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacke… |
CVE-2021-26295 | Critical | 9.8 | 2021-03-22 | Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. |
CVE-2020-36282 | Critical | 9.8 | 2021-03-12 | JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMess… |
CVE-2020-29045 | Critical | 9.8 | 2021-03-11 | The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_car… |
CVE-2021-21371 | Medium | 5.0 | 2021-03-10 | Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabil… |
CVE-2021-21488 | Medium | 6.5 | 2021-03-09 | Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without ver… |
CVE-2020-24914 | Critical | 9.8 | 2021-03-04 | A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and al… |
CVE-2020-24036 | High | 8.8 | 2021-03-04 | PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code. |
CVE-2020-29047 | Critical | 9.8 | 2021-03-03 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress… |
CVE-2021-20076 | High | 8.8 | 2021-03-03 | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to per… |
CVE-2021-26857 | High | 7.8 | 2021-03-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-24066 | High | 8.8 | 2021-02-25 | Microsoft SharePoint Remote Code Execution Vulnerability |