CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,829 vulnerabilities with CWE-502
CVE-2024-3468 HIGH
AVEVA PI Web API < 2023 - Remote Code Execution via API XML Import
CVE-2024-3467 HIGH
AVEVA PI Asset Framework Client - Remote Code Execution via Malicious XML Import
CVSS 7.8
CVE-2024-28964 HIGH
Dell Common Event Enabler < 8.9.10.0 - Unauthenticated Deserialization of Untrusted Data via CAVATools
CVSS 7.8
CVE-2024-35249 HIGH
Microsoft Dynamics 365 Business Central - Remote Code Execution via Untrusted Data Deserialization
CVSS 8.8
CVE-2024-36528 HIGH
nukeviet < 4.5.05 and egovernment < 1.2.02 - Remote Code Execution via Untrusted Data Deserialization
CVSS 8.8
CVE-2024-5675 CRITICAL
Mentor - Employee Portal <3.83.35 - Code Injection
CVSS 10.0
CVE-2024-33568 HIGH
BdThemes Element Pack Pro < 7.19.3 - Path Traversal and Object Injection
CVSS 8.5
CVE-2024-37065 HIGH
skops >= 0.6 - Remote Code Execution via Model Deserialization
CVSS 7.8
CVE-2024-37064 HIGH
ydata-profiling >= 3.7.0 - Remote Code Execution via Untrusted Data Deserialization
CVSS 7.8
CVE-2024-37062 HIGH
ydata-profiling >= 3.7.0 - Remote Code Execution via Malicious Report Deserialization
CVSS 7.8
CVE-2024-37060 HIGH
MLflow >= 1.27.0 - Remote Code Execution via Malicious Recipe Deserialization
CVSS 8.8
CVE-2024-37059 HIGH
MLflow >= 0.5.0 - Remote Code Execution via PyTorch Model Deserialization
CVSS 8.8
CVE-2024-37058 HIGH
MLflow >= 2.5.0 - Remote Code Execution via Langchain AgentExecutor Model Deserialization
CVSS 8.8
CVE-2024-37057 HIGH
MLflow >= 2.0.0 - Remote Code Execution via Tensorflow Model Deserialization
CVSS 8.8
CVE-2024-37056 HIGH
MLflow >= 1.23.0 - Remote Code Execution via LightGBM Model Deserialization
CVSS 8.8
CVE-2024-37055 HIGH
MLflow >= 1.24.0 - Remote Code Execution via Malicious Pmdarima Model Deserialization
CVSS 8.8
CVE-2024-37054 HIGH
MLflow >= 0.9.0 - Remote Code Execution via PyFunc Model Deserialization
CVSS 8.8
CVE-2024-37053 HIGH
MLflow >= 1.1.0 - Remote Code Execution via Malicious scikit-learn Model Deserialization
CVSS 8.8
CVE-2024-37052 HIGH
MLflow >= 1.1.0 - Remote Code Execution via Malicious scikit-learn Model Deserialization
CVSS 8.8
CVE-2024-3301 HIGH
DELMIA Apriso <2024 - Code Injection
CVSS 8.5
CVE-2024-3300 CRITICAL
DELMIA Apriso <2024 - Code Injection
CVSS 9.0
CVE-2024-26289 CRITICAL
PMB 7.3.1-7.3.17 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2024-5352 MEDIUM
Anji-plus AJ-Report <1.4.1 - Deserialization
CVSS 6.3
CVE-2024-5351 MEDIUM
Anji-plus AJ-Report <1.4.1 - Deserialization
CVSS 6.3
CVE-2024-5085 HIGH
Hash Form - Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection via process_entry Function
CVSS 8.1
Details
Vulnerabilities 2,829
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits