CWE-502 · Deserialization of Untrusted Data (page 30)
Page 30 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1999042 | Medium | 5.3 | 2018-08-23 | A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when dese… |
CVE-2018-1000641 | Critical | 9.8 | 2018-08-20 | YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result i… |
CVE-2018-15503 | High | 7.5 | 2018-08-18 | The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploi… |
CVE-2018-3784 | Critical | 9.8 | 2018-08-17 | A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization. |
CVE-2018-8349 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows… |
CVE-2018-12539 | High | 7.8 | 2018-08-14 | In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same mac… |
CVE-2018-14878 | High | 7.8 | 2018-08-13 | JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or… |
CVE-2018-15133 | High | 8.1 | 2018-08-09 | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X… |
CVE-2016-4405 | High | 8.8 | 2018-08-06 | A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.2… |
CVE-2016-4398 | High | 8.8 | 2018-08-06 | A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using… |
CVE-2016-8653 | Medium | 5.3 | 2018-08-01 | It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to la… |
CVE-2016-8648 | High | 7.2 | 2018-08-01 | It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An… |
CVE-2017-10934 | Critical | 9.8 | 2018-07-25 | All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) librar… |
CVE-2018-8018 | Critical | 9.8 | 2018-07-20 | In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, wh… |
CVE-2016-9498 | Critical | 9.8 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote use… |
CVE-2016-9483 | Critical | 9.8 | 2018-07-13 | The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated a… |
CVE-2018-1000210 | High | 7.8 | 2018-07-13 | YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deser… |
CVE-2017-18342 | Critical | 9.8 | 2018-06-27 | In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and… |
CVE-2018-1000527 | High | 7.2 | 2018-06-26 | Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote cod… |
CVE-2018-1000525 | Critical | 9.8 | 2018-06-26 | openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remot… |
CVE-2018-1000509 | High | 7.2 | 2018-06-26 | Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin… |
CVE-2018-6497 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31… |
CVE-2018-6496 | High | 8.8 | 2018-06-16 | Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow fo… |
CVE-2017-3207 | Critical | 9.8 | 2018-06-11 | The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rathe… |
CVE-2017-3203 | High | 8.1 | 2018-06-11 | The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specificat… |
CVE-2017-3202 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their… |
CVE-2017-3201 | High | 8.1 | 2018-06-11 | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rath… |
CVE-2017-3200 | High | 8.1 | 2018-06-11 | The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less… |
CVE-2017-3199 | High | 8.1 | 2018-06-11 | The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specificati… |
CVE-2018-8013 | Critical | 9.8 | 2018-05-24 | In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then… |
CVE-2018-10654 | High | 8.1 | 2018-05-23 | There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-1310 | High | 7.5 | 2018-05-23 | Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254… |
CVE-2018-4939 | Critical | 9.8 | 2018-05-19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerabilit… |
CVE-2017-2608 | High | 8.8 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in… |
CVE-2018-1131 | High | 8.8 | 2018-05-15 | Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access… |
CVE-2018-0824 | High | 8.8 | 2018-05-09 | A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows… |
CVE-2018-7891 | High | 8.1 | 2018-04-30 | The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Rem… |
CVE-2018-2628 | Critical | 9.8 | 2018-04-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are… |
CVE-2018-1000167 | High | 7.8 | 2018-04-18 | OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: conf… |
CVE-2018-10085 | Critical | 9.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.Login… |
CVE-2018-9843 | Critical | 9.8 | 2018-04-12 | The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET ob… |
CVE-2017-13286 | High | 7.8 | 2018-04-04 | In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. This could lead to a local escal… |
CVE-2018-1295 | Critical | 9.8 | 2018-04-02 | In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible… |
CVE-2015-2020 | Critical | 9.8 | 2018-03-29 | The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly… |
CVE-2017-1677 | High | 7.4 | 2018-03-22 | IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which l… |
CVE-2018-7529 | High | 7.5 | 2018-03-14 | A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data… |
CVE-2018-1000074 | High | 7.8 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2016-9585 | Medium | 5.3 | 2018-03-09 | Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacke… |
CVE-2018-7889 | High | 7.8 | 2018-03-08 | gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a craf… |
CVE-2018-0147 | Critical | 9.8 | 2018-03-08 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote at… |
CVE-2017-15693 | High | 7.5 | 2018-02-27 | In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objec… |
CVE-2017-15692 | Critical | 9.8 | 2018-02-27 | In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the… |
CVE-2018-7489 | Critical | 9.8 | 2018-02-26 | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete f… |
CVE-2017-8967 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8966 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8965 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8964 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8963 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-8962 | High | 8.8 | 2018-02-15 | A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-5792 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. |
CVE-2017-5790 | Critical | 9.8 | 2018-02-15 | A remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found. |
CVE-2017-12558 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found. |
CVE-2017-12557 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found. |
CVE-2017-12556 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found. |
CVE-2016-8519 | Critical | 9.8 | 2018-02-15 | A remote code execution vulnerability in HPE Operations Orchestration Community edition and Enterprise edition prior to v10.70 was found. |
CVE-2016-8511 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.00.01, v10.00.02, v… |
CVE-2017-15089 | High | 8.8 | 2018-02-15 | It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attack… |
CVE-2018-1000059 | Critical | 9.8 | 2018-02-09 | ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthoris… |
CVE-2018-1000058 | High | 8.8 | 2018-02-09 | Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deseri… |
CVE-2018-1000048 | High | 8.8 | 2018-02-09 | NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code… |
CVE-2018-1000047 | High | 8.8 | 2018-02-09 | NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack ap… |
CVE-2018-1000046 | High | 7.8 | 2018-02-09 | NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to… |
CVE-2018-1000045 | High | 7.8 | 2018-02-09 | NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code execution. This attack app… |
CVE-2016-3957 | Critical | 9.8 | 2018-02-06 | The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow re… |
CVE-2017-7525 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform… |
CVE-2017-15095 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code ex… |
CVE-2017-1000355 | Medium | 6.5 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void. |
CVE-2017-1000353 | Critical | 9.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code… |
CVE-2017-4947 | Critical | 9.8 | 2018-01-29 | VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful explo… |
CVE-2017-15703 | Medium | 5.0 | 2018-01-25 | Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of ser… |
CVE-2018-1051 | High | 8.1 | 2018-01-25 | It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()`… |
CVE-2017-17406 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required… |
CVE-2018-5968 | High | 8.1 | 2018-01-22 | FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2016-6814 | Critical | 9.8 | 2018-01-18 | When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serializatio… |
CVE-2017-17485 | Critical | 9.8 | 2018-01-10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2014-9515 | Critical | 9.8 | 2017-12-29 | Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized obj… |
CVE-2017-5641 | Critical | 9.8 | 2017-12-28 | Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the… |
CVE-2017-17672 | Critical | 9.8 | 2017-12-14 | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, c… |
CVE-2017-11284 | Critical | 9.8 | 2017-12-01 | Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier… |
CVE-2017-11283 | Critical | 9.8 | 2017-12-01 | Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier… |
CVE-2017-1000207 | High | 8.8 | 2017-11-27 | A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed… |
CVE-2017-8045 | Critical | 9.8 | 2017-11-27 | In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted i… |
CVE-2017-4995 | High | 8.1 | 2017-11-27 | An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing… |
CVE-2017-1000248 | Critical | 9.8 | 2017-11-17 | Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis |
CVE-2017-1000208 | High | 8.8 | 2017-11-17 | A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Ope… |
CVE-2017-1000195 | High | 7.5 | 2017-11-17 | October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the… |
CVE-2017-12634 | Critical | 9.8 | 2017-11-15 | The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializi… |
CVE-2017-12633 | Critical | 9.8 | 2017-11-15 | The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializ… |
CVE-2015-7501 | Critical | 9.8 | 2017-11-09 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x… |
CVE-2017-1000148 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML thr… |