CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,822 vulnerabilities with CWE-502
CVE-2024-13297 MEDIUM
Drupal Eloqua <7.X-1.15 - Code Injection
CVSS 6.6
CVE-2024-13296 MEDIUM
Drupal Mailjet <4.0.1 - Code Injection
CVSS 6.6
CVE-2024-13295 MEDIUM
Drupal Node export 7.x-3.0-7.x-3.2 - Object Injection via Untrusted Data Deserialization
CVSS 6.6
CVE-2024-13288 MEDIUM
Drupal Monster Menus <9.3.4-9.4.2 - Deserialization
CVSS 4.3
CVE-2024-54676 CRITICAL
Apache OpenMeetings 2.1.0-8.0.0 - Deserialization of Untrusted Data via OpenJPA Configuration
CVSS 9.8
CVE-2024-55555 HIGH
Invoice Ninja < 5.10.43 - Unauthenticated Remote Code Execution via Route Hash Deserialization
CVSS 8.8
CVE-2024-55556 CRITICAL
Crater Invoice - Unauthenticated Remote Code Execution via Laravel Session Cookie Deserialization
CVSS 9.8
CVE-2024-56291 HIGH
Plainware.com PlainInventory <3.1.6 - Code Injection
CVSS 8.1
CVE-2024-56283 HIGH
plainware.com Locatoraid Store Locator <3.9.50 - Object Injection
CVSS 8.1
CVE-2024-49222 CRITICAL
WPGuppy <= 1.1.0 - PHP Object Injection via Untrusted Data Deserialization
CVSS 9.8
CVE-2024-12313 HIGH
Compare Products for WooCommerce <3.2.1 - Code Injection
CVSS 8.1
CVE-2024-11465 HIGH
Custom Product Tabs for WooCommerce <1.8.5 - Code Injection
CVSS 7.2
CVE-2024-20150 HIGH
MediaTek LR12A, LR13, NR15, NR16, NR17 - Remote Denial of Service via Deserialization Logic Error
CVSS 7.5
CVE-2024-13136 MEDIUM
wangl1989 mysiteforme 1.0 - Deserialization
CVSS 6.3
CVE-2024-10957 HIGH
UpdraftPlus: WP Backup & Migration Plugin <1.24.11 - Code Injection
CVSS 8.8
CVE-2024-10932 HIGH
WordPress Backup Migration <1.4.6 - Code Injection
CVSS 8.8
CVE-2024-56068 HIGH
Azzaroco WP SuperBackup <2.3.3 - Deserialization
CVSS 7.5
CVE-2024-12994 MEDIUM
running-elephant Datart 1.0.0-rc3 - Deserialization
CVSS 6.3
CVE-2024-52046 CRITICAL
Apache MINA 2.0.0-2.0.26, 2.1.0-2.1.9, 2.2.0-2.2.3 - Remote Code Execution via ObjectSerializationDecoder
CVSS 9.8
CVE-2024-12721 HIGH
Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated PHP Object Injection via wb_custom_tabs Parameter
CVSS 7.2
CVE-2024-12677 HIGH
Delta Electronics DTM Soft - Code Injection
CVSS 7.8
CVE-2024-12741 HIGH
NI DAQExpress <5.1 - Code Injection
CVSS 7.8
CVE-2024-56058 CRITICAL
Gueststream VRPConnector <2.0.1 - Code Injection
CVSS 9.8
CVE-2024-12687 CRITICAL
PlexTrac 1.61.3-2.8.1 - Deserialization of Untrusted Data in Runbooks Modules
CVSS 9.8
CVE-2024-10095 HIGH
Telerik UI for WPF <2024 Q4 - Code Injection
CVSS 8.4
Details
Vulnerabilities 2,822
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits