CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,831 vulnerabilities with CWE-502
CVE-2023-21779 HIGH
Visual Studio Code < 1.74.3 - Remote Code Execution via Untrusted Data Deserialization
CVSS 7.8
CVE-2023-21762 HIGH
Microsoft Exchange Server - Spoofing via Deserialization of Untrusted Data
CVSS 8.0
CVE-2023-21745 HIGH
Microsoft Exchange Server - Spoofing via Deserialization of Untrusted Data
CVSS 8.0
CVE-2023-21744 HIGH
Microsoft SharePoint Foundation and Server - Remote Code Execution via Untrusted Data Deserialization
CVSS 8.8
CVE-2023-21538 HIGH
.NET - Denial of Service via Untrusted Data Deserialization
CVSS 7.5
CVE-2022-45134 CRITICAL
Mahara 21.10.0-21.10.5, 22.04.0-22.04.3, 22.10.0 - Remote Code Execution via Skin Import XML Deserialization
CVSS 9.8
CVE-2022-45185 HIGH
SuiteCRM 7.12.7 - Authenticated Remote Code Execution via Deserialization
CVSS 8.8
CVE-2022-41137 HIGH
Apache Hive - Remote Code Execution
CVSS 8.3
CVE-2022-2439 HIGH
Easy Digital Downloads < 3.3.4 - Authenticated Deserialization of Untrusted Data via Upload File Parameter
CVSS 7.2
CVE-2022-2446 HIGH
WP Editor <= 1.2.9 - Authenticated Deserialization of Untrusted Data via current_theme_root Parameter
CVSS 7.2
CVE-2022-2440 HIGH
Theme Editor < 2.8 - Authenticated Deserialization of Untrusted Data via images_array Parameter
CVSS 7.2
CVE-2022-45147 HIGH
SIMATIC PCS neo V4.0-STEP 7 V18 - Code Injection
CVSS 7.8
CVE-2022-45845 MEDIUM
Nextend Smart Slider 3 <= 3.5.1.9 - PHP Object Injection via Untrusted Data Deserialization
CVSS 4.3
CVE-2022-45083 MEDIUM
ProfilePress < 4.3.2 - PHP Object Injection via Untrusted Data Deserialization
CVSS 6.6
CVE-2022-34268 CRITICAL
RWS WorldServer < 11.7.3 - Unauthenticated Remote Code Execution via Java Deserialization
CVSS 9.8
CVE-2022-47599 MEDIUM
File Manager by Bit Form Team < 5.2.7 - Deserialization of Untrusted Data
CVSS 5.5
CVE-2022-3342 HIGH
Jetpack CRM <5.3.1 - Code Injection
CVSS 7.5
CVE-2022-1415 HIGH
Redhat Decision Manager < 7.69.0.Final - Insecure Deserialization
CVSS 8.1
CVE-2022-40609 HIGH
IBM SDK < 7.1.5.19 - Remote Code Execution via Unsafe Deserialization
CVSS 8.1
CVE-2022-4815 HIGH
Hitachi Vantara Pentaho Business Analytics Server <9.4.0.1-9.3.0.3 ...
CVSS 8.0
CVE-2022-36978 CRITICAL
Ivanti Avalanche 6.3.2.3490-6.3.4 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2022-36977 CRITICAL
Ivanti Avalanche 6.3.2.3490-<6.3.4 - Remote Code Execution via Certificate Management Server Deserialization
CVSS 9.8
CVE-2022-36974 CRITICAL
Ivanti Avalanche 6.3.2.3490-6.3.4 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2022-36971 HIGH
Ivanti Avalanche 6.3.2.3490-6.3.4 - Remote Code Execution via JwtTokenUtility Deserialization
CVSS 8.8
CVE-2022-2561 HIGH
OPC Labs QuickOPC 5.63-5.63.246 - Remote Code Execution via XML Deserialization in Connectivity Explorer
CVSS 7.8
Details
Vulnerabilities 2,831
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits