CWE-502 · Deserialization of Untrusted Data (page 30)

Page 30 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-502 — newest first (page 30 of 34)
CVESeverityScorePublishedSummary
CVE-2020-11982Critical9.82020-07-17An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly…
CVE-2020-12015High7.52020-07-16A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue aff…
CVE-2020-12007Critical9.82020-07-16A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserializat…
CVE-2020-12009High7.52020-07-16A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This aff…
CVE-2020-14000Critical9.82020-07-16MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ chara…
CVE-2020-9496Medium6.12020-07-15XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
CVE-2020-1439High8.82020-07-14A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file…
CVE-2020-1948Critical9.82020-07-14This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name a…
CVE-2020-4305High8.82020-07-09IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of…
CVE-2020-14172Critical9.82020-07-03This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in w…
CVE-2020-2211High8.82020-07-02Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultin…
CVE-2013-7489Medium6.82020-06-26The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.
CVE-2020-10740Medium6.62020-06-22A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB…
CVE-2020-14942Critical9.82020-06-21Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
CVE-2020-14933High8.82020-06-20compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this bec…
CVE-2020-14932Critical9.82020-06-20compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
CVE-2020-8165Critical9.82020-06-19A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects i…
CVE-2020-8164High7.52020-06-19A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadverte…
CVE-2020-14195High8.12020-06-16FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRea…
CVE-2020-14060High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JN…
CVE-2020-14062High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.interna…
CVE-2020-14061High8.12020-06-14FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionF…
CVE-2020-5411High8.12020-06-11When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vul…
CVE-2020-0132Medium5.52020-06-11In BnAAudioService::onTransact of IAAudioService.cpp, there is a possible out of bounds read due to unsafe deserialization. This could lead to local informatio…
CVE-2020-4043High7.72020-06-10phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected…
CVE-2020-12000High7.52020-06-09The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can re…
CVE-2020-10644High7.52020-06-09The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions p…
CVE-2020-4450Critical9.82020-06-05IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequenc…
CVE-2020-4449High7.52020-06-05IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequ…
CVE-2020-4448Critical9.82020-06-05IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special…
CVE-2020-7660High8.12020-06-01serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
CVE-2020-12390Critical9.82020-05-26Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.
CVE-2020-3280Critical9.82020-05-22A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker t…
CVE-2018-21234Critical9.82020-05-21Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2020-9484High7.02020-05-20When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con…
CVE-2020-12835Critical9.82020-05-20An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inj…
CVE-2020-13092Critical9.82020-05-15scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce…
CVE-2020-13091Critical9.82020-05-15pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system…
CVE-2020-11973Critical9.82020-05-14Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgra…
CVE-2020-11972Critical9.82020-05-14Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should up…
CVE-2020-11067High8.82020-05-14In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure des…
CVE-2019-16112High8.82020-05-13TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?servic…
CVE-2020-12760High8.82020-05-11An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed fo…
CVE-2020-5741High7.22020-05-08Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
CVE-2020-2189High8.82020-05-06Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote co…
CVE-2020-12471Critical9.82020-04-29MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx because of deserialization in…
CVE-2020-12469Medium6.52020-04-29admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a blo…
CVE-2020-12133Critical9.82020-04-27The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserializa…
CVE-2020-10915Critical9.82020-04-22This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…
CVE-2020-10914Critical9.82020-04-22This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…
CVE-2020-0082High7.82020-04-17In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local e…
CVE-2020-2180High8.82020-04-16Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi…
CVE-2020-2179High8.82020-04-16Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execu…
CVE-2020-1964Critical9.82020-04-16It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent th…
CVE-2020-4272High8.82020-04-15IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted request specify a…
CVE-2020-4271Medium6.32020-04-15IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be executed as a lower privileged user. IBM…
CVE-2020-2757Low3.72020-04-15Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8…
CVE-2020-2756Low3.72020-04-15Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8…
CVE-2020-6219High8.82020-04-14SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta…
CVE-2020-11630Critical9.82020-04-08An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes…
CVE-2020-11620High8.12020-04-07FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Em…
CVE-2020-11619High8.12020-04-07FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.M…
CVE-2019-17564Critical9.82020-04-01Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to com…
CVE-2020-11467High7.22020-04-01An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-them…
CVE-2019-2391Medium4.22020-03-31Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data di…
CVE-2020-11113High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistr…
CVE-2020-11112High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provide…
CVE-2020-11111High8.82020-03-31FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activ…
CVE-2020-7610Critical9.82020-03-30All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leadi…
CVE-2020-10969High8.82020-03-26FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968High8.82020-03-26FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remo…
CVE-2020-6967Critical9.82020-03-23In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .N…
CVE-2020-7961Critical9.82020-03-20Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
CVE-2020-10673High8.82020-03-18FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.Resource…
CVE-2020-10672High8.82020-03-18FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms…
CVE-2019-20453High8.82020-03-17A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownl…
CVE-2019-20452High8.82020-03-17A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/Recycle…
CVE-2020-1947Critical9.82020-03-11In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource…
CVE-2017-10992Critical9.82020-03-10In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvoke…
CVE-2016-1487High8.82020-03-09Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization.
CVE-2020-2158High8.82020-03-09Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio…
CVE-2020-5327High8.12020-03-06Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the…
CVE-2020-10189Critical9.82020-03-06Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage…
CVE-2019-14893Critical9.82020-03-02A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious ob…
CVE-2019-14892Critical9.82020-03-02A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious obj…
CVE-2020-9548Critical9.82020-03-02FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPC…
CVE-2020-9547Critical9.82020-03-02FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transac…
CVE-2020-9546Critical9.82020-03-02FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zax…
CVE-2019-5326High7.22020-02-27An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. Thi…
CVE-2020-8441Critical9.82020-02-19JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
CVE-2019-20477Critical9.82020-02-19PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in t…
CVE-2020-9006Critical9.82020-02-17The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deser…
CVE-2020-8801High7.22020-02-13SuiteCRM through 7.11.11 allows PHAR Deserialization.
CVE-2020-2123High8.82020-02-12Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio…
CVE-2020-0618High8.82020-02-11A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Re…
CVE-2020-8840Critical9.82020-02-10FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVE-2020-6770Critical10.02020-02-07Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system…
CVE-2013-4521Critical9.82020-02-06RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be call…
CVE-2020-3716Critical9.82020-01-29Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. S…
CVE-2019-17570Critical9.82020-01-23An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malic…