CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,844 vulnerabilities with CWE-502
CVE-2017-3200 HIGH
GraniteDS - Remote Code Execution via AMF3 Deserialization
CVSS 8.1
CVE-2017-3199 HIGH
GraniteDS 3.1.1.GA - Remote Code Execution via AMF3 Deserialization
CVSS 8.1
CVE-2017-2608 HIGH
Jenkins < 2.44 and < 2.32.2 - Remote Code Execution via XStream Deserialization
CVSS 8.8
CVE-2017-13286 HIGH
Android 8.0-8.1 - Local Privilege Escalation via OutputConfiguration Serialization Mismatch
CVSS 7.8
CVE-2017-1677 HIGH
IBM DB2 for Linux, UNIX and Windows <11.1 - Code Injection
CVSS 7.4
CVE-2017-15693 HIGH
Apache Geode < 1.4.0 - Remote Code Execution via Untrusted Data Deserialization
CVSS 7.5
CVE-2017-15692 CRITICAL
Apache Geode < 1.4.0 - Remote Code Execution via TcpServer Deserialization
CVSS 9.8
CVE-2017-8967 HIGH
Hewlett Packard Enterprise iMC <7.3 - Deserialization
CVSS 8.8
CVE-2017-8966 HIGH
Hewlett Packard Enterprise iMC <7.3 E0504P2 - Deserialization
CVSS 8.8
CVE-2017-8965 HIGH
Hewlett Packard Enterprise iMC <7.3 E0504P2 - Deserialization
CVSS 8.8
CVE-2017-8964 HIGH
Hewlett Packard Enterprise iMC <7.3 E0504P2 - Deserialization
CVSS 8.8
CVE-2017-8963 HIGH
Hewlett Packard Enterprise iMC <7.3 - Deserialization
CVSS 8.8
CVE-2017-8962 HIGH
Hewlett Packard Enterprise iMC <7.3 E0504P2 - Deserialization
CVSS 8.8
CVE-2017-5792 CRITICAL
HPE Intelligent Management Center PLAT 7.3 E0504P2 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2017-5790 CRITICAL
HPE Intelligent Management Center PLAT 7.2 E0403P06 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2017-12558 CRITICAL
HPE Intelligent Management Center PLAT < 7.3 E0504P2 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2017-12557 CRITICAL
HPE Intelligent Management Center < 7.3 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2017-12556 CRITICAL
HPE Intelligent Management Center < 7.3 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2017-15089 HIGH
Infinispan < 9.1.6 and < 9.2.0.CR1 - Authenticated Deserialization of Untrusted Data via Hotrod Client
CVSS 8.8
CVE-2017-7525 CRITICAL
jackson-databind <2.6.7.1, <2.7.9.1, <2.8.9 - Code Injection
CVSS 9.8
CVE-2017-15095 CRITICAL
jackson-databind <2.8.10, 2.9.1 - Code Injection
CVSS 9.8
CVE-2017-1000355 MEDIUM
Jenkins < 2.56 and < 2.46.1 - Denial of Service via XStream Void Type Instantiation
CVSS 6.5
CVE-2017-1000353 CRITICAL KEV
Jenkins < 2.56 and < 2.46.1 - Unauthenticated Remote Code Execution via Java Deserialization
CVSS 9.8
CVE-2017-4947 CRITICAL
VMware vRealize Automation 7.2-7.3 & vSphere Integrated Containers <1.3.0 RCE via Xenon Deserialization
CVSS 9.8
CVE-2017-15703 MEDIUM
Apache NiFi 1.0.0-1.3.0 - Authenticated Denial of Service via Java Deserialization
CVSS 5.0
Details
Vulnerabilities 2,844
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits