CWE-502 · Deserialization of Untrusted Data (page 36)
Page 36 of 36 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5929 | Critical | 9.8 | 2017-03-13 | QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. |
CVE-2017-3159 | Critical | 9.8 | 2017-03-07 | Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. |
CVE-2017-5830 | Critical | 9.8 | 2017-03-03 | Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts. |
CVE-2016-0360 | Critical | 9.8 | 2017-02-15 | IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user t… |
CVE-2017-5954 | Critical | 9.8 | 2017-02-10 | An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arb… |
CVE-2017-5941 | Critical | 9.8 | 2017-02-09 | An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbi… |
CVE-2016-6199 | Critical | 9.8 | 2017-02-07 | ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object. |
CVE-2016-3415 | Critical | 9.1 | 2017-01-18 | Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276. |
CVE-2016-9865 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() fun… |
CVE-2016-6620 | Critical | 9.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserial… |
CVE-2016-7065 | High | 8.8 | 2016-10-13 | The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly exec… |
CVE-2016-5019 | Critical | 9.8 | 2016-10-03 | CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers… |
CVE-2016-4385 | High | 7.3 | 2016-09-29 | The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitra… |
CVE-2016-6330 | Critical | 9.8 | 2016-09-27 | The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers t… |
CVE-2016-4978 | High | 7.2 | 2016-09-27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Art… |
CVE-2016-7124 | Critical | 9.8 | 2016-09-12 | ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial… |
CVE-2016-1114 | Critical | 9.8 | 2016-05-11 | Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serializ… |
CVE-2015-7450 | Critical | 9.8 | 2016-01-02 | Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers… |
CVE-2015-6420 | Critical | 9.8 | 2015-12-15 | Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Accelerat… |
CVE-2015-8103 | Critical | 9.8 | 2015-11-25 | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object… |
CVE-2015-4852 | Critical | 9.8 | 2015-11-18 | The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a cra… |
CVE-2013-4271 | | 2013-10-10 | The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers… | |
CVE-2013-1465 | Critical | 9.8 | 2013-02-08 | The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a c… |
CVE-2012-4406 | Critical | 9.8 | 2012-10-22 | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, whic… |
CVE-2012-3527 | | 2012-09-05 | view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to… | |
CVE-2012-0911 | Critical | 9.8 | 2012-07-12 | TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieNam… |
CVE-2011-2894 | | 2011-10-04 | Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrust… | |
CVE-2011-2520 | High | 7.8 | 2011-07-21 | fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, whic… |
CVE-2010-4574 | | 2010-12-22 | The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms does not properly… | |
CVE-2010-3258 | | 2010-09-07 | The sandbox implementation in Google Chrome before 6.0.472.53 does not properly deserialize parameters, which has unspecified impact and remote attack vectors. | |
CVE-2007-1701 | | 2007-03-27 | PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization… | |
CVE-2003-0791 | Critical | 9.8 | 2003-10-07 | The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to t… |