cve.bz

CWE-502: Deserialization of Untrusted Data, page 54

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2023-1139EPSS 1.3%

    Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in re…

  2. 9.8CVE-2023-1133ExploitEPSS 50%

    Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the conten…

  3. 9.8CVE-2023-26359KEVEPSS 17%

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Expl…

  4. 9.8CVE-2023-28667EPSS 1.1%

    The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being s…

  5. 7.8CVE-2023-27978EPSS 6.5%

    A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a m…

  6. 9.8CVE-2023-28115EPSS 2.8%

    Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `fi…

  7. 7.5CVE-2023-26464EPSS 1.9%Unsupported when assigned

    When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging…

  8. 9.8CVE-2023-23638EPSS 4.9%

    A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior version…

  9. 9.8CVE-2023-26779EPSS 1.4%

    CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).

  10. 9.8CVE-2022-37936EPSS 0.8%

    Unauthenticated Java deserialization vulnerability in Serviceguard Manager

  11. 9.8CVE-2023-27372ExploitEPSS 99.6%

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

  12. 7.8CVE-2023-20944EPSS 0.2%

    In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…

  13. 9.8CVE-2022-23535EPSS 0.7%

    LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to P…

  14. 9.8CVE-2023-26326EPSS 3.8%

    The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize …

  15. 9.8CVE-2023-0960EPSS 1.0%

    A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. T…

  16. 7.2CVE-2022-48282EPSS 1.4%

    Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. …

  17. 9.8CVE-2023-26234EPSS 0.8%

    JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.

  18. 9.8CVE-2022-47986KEVExploitEPSS >99.9%

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit thi…

  19. 7.2CVE-2023-23836EPSS 80%

    SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrar…

  20. 7.2CVE-2022-47507EPSS 13%

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

  21. 7.2CVE-2022-47504EPSS 42%

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

  22. 7.2CVE-2022-47503EPSS 41%

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

  23. 7.2CVE-2022-38111EPSS 85%

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

  24. 8.8CVE-2023-21713EPSS 1.8%

    Microsoft SQL Server Remote Code Execution Vulnerability

  25. 7.2CVE-2023-21710EPSS 7.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  26. 8.8CVE-2023-21707EPSS 82%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  27. 8.8CVE-2023-21706EPSS 4.1%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  28. 7.2CVE-2023-21703EPSS 1.5%

    Azure Data Box Gateway Remote Code Execution Vulnerability

  29. 7.3CVE-2023-21568EPSS 0.9%

    Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability

  30. 8.8CVE-2023-21529KEVEPSS 59%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  31. 8.8CVE-2023-25558EPSS 1.0%

    DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted …

  32. 8.8CVE-2022-3568EPSS 0.6%

    The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHA…

  33. 9.8CVE-2022-45982EPSS 1.2%

    thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

  34. 8.8CVE-2023-25194ExploitEPSS 96%

    A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL…

  35. 7.2CVE-2023-0669KEVExploitEPSS >99.9%

    Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version…

  36. 9.8CVE-2023-25135ExploitEPSS 24%

    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling uns…

  37. 9.8CVE-2023-24997EPSS 1.3%

    Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://…

  38. 9.8CVE-2023-24162EPSS 1.3%

    Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

  39. 8.8CVE-2022-44645EPSS 1.9%

    In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL dat…

  40. 8.8CVE-2022-32521EPSS 0.5%

    A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prio…

  41. 7.5CVE-2022-31710EPSS 1.5%

    vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.

  42. 8.8CVE-2022-45923EPSS 1.9%

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increase/decrease an arbitrary memory address by 1 and trigger a call to a method of a …

  43. 7.5CVE-2023-21839KEVExploitEPSS 99.9%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated at…

  44. 9.8CVE-2022-4890EPSS 0.8%

    A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The man…

  45. 8.8CVE-2023-22850EPSS 1.2%

    Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.

  46. 9.8CVE-2022-46478EPSS 2.0%

    The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.

  47. 8.8CVE-2022-41778EPSS 1.1%

    Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects…

  48. 7.8CVE-2023-21779EPSS 2.3%

    Visual Studio Code Remote Code Execution Vulnerability

  49. 8.0CVE-2023-21762EPSS 1.6%

    Microsoft Exchange Server Spoofing Vulnerability

  50. 8.0CVE-2023-21745EPSS 1.5%

    Microsoft Exchange Server Spoofing Vulnerability