cve.bz

CWE-502: Deserialization of Untrusted Data, page 67

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2019-16943EPSS 4.7%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy…

  2. 9.8CVE-2019-16942EPSS 5.7%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commo…

  3. 9.8CVE-2019-10202EPSS 5.2%

    A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported …

  4. 5.5CVE-2019-9373EPSS 0.2%

    In JobStore, there is a mismatched serialization/deserialization for the "battery-not-low" job attribute. This could lead to a local denial of service with no additional execution privileges needed. User interaction is not needed for explo…

  5. 9.8CVE-2019-9365EPSS 1.0%

    In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: An…

  6. 9.8CVE-2019-16894ExploitEPSS 3.0%

    download.php in inoERP 4.15 allows SQL injection through insecure deserialization.

  7. 9.8CVE-2019-16755EPSS 2.5%

    BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perform pre-authenticated remote commands execution on the Operating System running the targeted applica…

  8. 8.8CVE-2019-11666EPSS 1.2%

    Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deseriali…

  9. 9.8CVE-2019-0195EPSS 14%

    Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most prob…

  10. 9.8CVE-2019-16335EPSS 4.9%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

  11. 9.8CVE-2019-14540EPSS 11%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

  12. 8.8CVE-2019-16317EPSS 1.7%

    In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../…

  13. 9.8CVE-2019-0189EPSS 24%

    The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the r…

  14. 9.8CVE-2017-18605EPSS 2.3%

    The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.

  15. 7.5CVE-2017-18604EPSS 1.6%

    The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.

  16. 7.2CVE-2019-14224EPSS 5.1%

    An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution on the victim…

  17. 8.8CVE-2019-5069EPSS 2.3%

    A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigg…

  18. 9.8CVE-2018-11569EPSS 1.7%

    Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5.2.

  19. 9.8CVE-2019-15780EPSS 2.4%

    The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.

  20. 9.8CVE-2019-15521EPSS 2.5%

    Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.

  21. 9.8CVE-2018-20987EPSS 2.1%

    The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.

  22. 9.8CVE-2019-11030EPSS 2.0%

    Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collect…

  23. 9.8CVE-2019-15321EPSS 2.1%

    The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

  24. 9.8CVE-2019-15320EPSS 2.1%

    The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

  25. 9.8CVE-2019-15319EPSS 2.1%

    The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

  26. 9.8CVE-2018-20984EPSS 2.0%

    The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

  27. 7.3CVE-2019-10086EPSS 29%

    In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using t…

  28. 9.8CVE-2019-0344KEVEPSS 7.5%

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Inje…

  29. 7.5CVE-2019-14439EPSS 11%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has…

  30. 9.8CVE-2018-11779EPSS 3.5%

    In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

  31. 9.8CVE-2019-10173EPSS 95%

    It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when…

  32. 9.8CVE-2019-1010306EPSS 4.0%

    Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector…

  33. 7.2CVE-2019-10135EPSS 1.9%

    A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML…

  34. 9.8CVE-2018-11307EPSS 5.7%

    An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

  35. 8.8CVE-2019-12747EPSS 1.5%

    TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

  36. 5.9CVE-2019-12384EPSS 45%

    FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execut…

  37. 9.8CVE-2019-11011EPSS 2.6%

    Akamai CloudTest before 58.30 allows remote code execution.

  38. 9.8CVE-2018-15890EPSS 2.9%

    An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the…

  39. 5.9CVE-2019-12814EPSS 11%

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or …

  40. 7.2CVE-2019-12868EPSS 6.2%

    app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.

  41. 8.8CVE-2019-12799ExploitEPSS 54%

    In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can…

  42. 9.8CVE-2019-7840EPSS 17%

    ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

  43. 3.3CVE-2019-12760EPSS 1.5%

    A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can …

  44. 8.8CVE-2019-11080ExploitEPSS 14%

    Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted se…

  45. 8.8CVE-2019-11956EPSS 5.7%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  46. 8.8CVE-2019-11950EPSS 5.7%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  47. 8.8CVE-2019-5350EPSS 5.7%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  48. 9.8CVE-2019-11945EPSS 79%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  49. 9.8CVE-2019-11944EPSS 13%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  50. 9.8CVE-2019-10069EPSS 3.4%

    In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.