CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,822 vulnerabilities with CWE-502
CVE-2024-54367 CRITICAL
Ultimate Member ForumWP <= 2.1.0 - PHP Object Injection via Untrusted Data Deserialization
CVSS 9.8
CVE-2024-54282 HIGH
Themeum WP Mega Menu <1.4.2 - Code Injection
CVSS 7.2
CVE-2024-54273 CRITICAL
PickPlugins Mail Picker <1.0.14 - Code Injection
CVSS 9.8
CVE-2024-11839 HIGH
PlexTrac 1.61.3-2.8.1 - Deserialization of Untrusted Data in Runbooks Modules
CVSS 7.5
CVE-2024-49147 CRITICAL
Microsoft Update Catalog - Unauthenticated Privilege Escalation via Untrusted Data Deserialization
CVSS 9.3
CVE-2024-12312 HIGH
Print Science Designer <1.3.152 - Code Injection
CVSS 8.1
CVE-2024-49070 HIGH
Microsoft SharePoint Server - Remote Code Execution via Untrusted Data Deserialization
CVSS 7.4
CVE-2024-49063 HIGH
Microsoft Muzic < 196.0 - Remote Code Execution via Untrusted Data Deserialization
CVSS 8.4
CVE-2024-11949 HIGH
GFI Archiver < 15.7 - Authenticated Remote Code Execution via Store Service Deserialization
CVSS 8.8
CVE-2024-11947 HIGH
GFI Archiver < 15.7 - Authenticated Remote Code Execution via Core Service Deserialization
CVSS 8.8
CVE-2024-53247 HIGH
Splunk Enterprise <9.3.2, 9.2.4, 9.1.7 - RCE
CVSS 8.8
CVE-2024-49849 HIGH
SIMATIC S7-PLCSIM,STEP 7 - Info Disclosure
CVSS 7.8
CVE-2024-55638 CRITICAL
Drupal 7.0-7.101, 8.8.0-10.2.10, 10.3.0-10.3.8 - Deserialization of Untrusted Data
CVSS 9.8
CVE-2024-55637 CRITICAL
Drupal 8.0.0-10.2.10 10.3.0-10.3.8 11.0.0-11.0.7 - Object Injection via Insecure Deserialization
CVSS 9.8
CVE-2024-55636 CRITICAL
Drupal 8.0.0-10.2.10 10.3.0-10.3.8 11.0.0-11.0.7 - Object Injection via Insecure Deserialization
CVSS 9.8
CVE-2024-11501 HIGH
Gallery < 1.3 - Authenticated PHP Object Injection via wd_gallery_$id Parameter
CVSS 8.8
CVE-2024-54136 CRITICAL
ClipBucket V5 <5.5.1.199 - Code Injection
CVSS 9.8
CVE-2024-54135 CRITICAL
ClipBucket V5 <5.5.1 - Code Injection
CVSS 9.8
CVE-2024-12138 MEDIUM
horilla < 1.2.1 - Remote Code Execution via Untrusted Data Deserialization
CVSS 6.3
CVE-2024-10587 HIGH
Funnelforms Free <3.7.4.1 - Code Injection
CVSS 8.8
CVE-2024-51363 CRITICAL
Hodoku 2.3.0-2.3.2 - Remote Code Execution via Insecure Deserialization
CVSS 9.8
CVE-2024-53477 CRITICAL
JFinal CMS 5.1.0 - Remote Code Execution via Unauthorized Deserialization in ApiForm.java
CVSS 9.8
CVE-2024-52338 CRITICAL
Apache Arrow R <16.1.0 - Code Injection
CVSS 9.8
CVE-2024-53673 HIGH
HPE Insight Remote Support < 7.14.0.629 - Unauthenticated Remote Code Execution via Java Deserialization
CVSS 8.1
CVE-2024-11145 CRITICAL
Easy Folder Listing Pro < 4.5 - Unauthenticated Remote Code Execution via Deserialization
CVSS 9.8
Details
Vulnerabilities 2,822
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits