CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,842 vulnerabilities with CWE-502
CVE-2020-11113 HIGH
FasterXML Jackson-Databind <2.9.10.4 - Code Injection
CVSS 8.8
CVE-2020-11112 HIGH
FasterXML jackson-databind <2.9.10.4 - RCE
CVSS 8.8
CVE-2020-11111 HIGH
FasterXML jackson-databind <2.9.10.4 - Code Injection
CVSS 8.8
CVE-2020-7610 CRITICAL
mongodb/bson < 1.1.4 - Deserialization of Untrusted Data via _bsotype Handling
CVSS 9.8
CVE-2020-10969 HIGH
jackson-databind 2.7.0-2.7.9.6 - Deserialization of Untrusted Data via javax.swing.JEditorPane
CVSS 8.8
CVE-2020-10968 HIGH
FasterXML Jackson-Databind <2.9.10.4 - Code Injection
CVSS 8.8
CVE-2020-6967 CRITICAL
Rockwell Automation FactoryTalk Services Platform - Deserialization of Untrusted Data via .NET Remoting Endpoint
CVSS 9.8
CVE-2020-7961 CRITICAL KEV
Liferay Portal <7.2.1 CE GA2 - Code Injection
CVSS 9.8
CVE-2020-10673 HIGH
FasterXML jackson-databind <2.9.10.4 - Code Injection
CVSS 8.8
CVE-2020-10672 HIGH
FasterXML jackson-databind <2.9.10.4 - Code Injection
CVSS 8.8
CVE-2020-1947 CRITICAL
Apache ShardingSphere 4.0.0-RC3-4.0.0 - Remote Code Execution via SnakeYAML Deserialization
CVSS 9.8
CVE-2020-2158 HIGH
Jenkins Literate Plugin < 1.0 - Remote Code Execution via YAML Deserialization
CVSS 8.8
CVE-2020-5327 HIGH
Dell Security Management Server < 10.2.10 - Unauthenticated Remote Code Execution via Java RMI Deserialization
CVSS 8.1
CVE-2020-10189 CRITICAL KEV
ManageEngine Desktop Central < 10.0.479 - Remote Code Execution via Java Deserialization in FileStorage
CVSS 9.8
CVE-2020-9548 CRITICAL
jackson-databind 2.0.0-2.7.9.7 - Deserialization of Untrusted Data via anteros-core Gadget
CVSS 9.8
CVE-2020-9547 CRITICAL
jackson-databind 2.0.0-2.7.9.7 - Deserialization of Untrusted Data via com.ibatis.sqlmap Gadget
CVSS 9.8
CVE-2020-9546 CRITICAL
jackson-databind 2.7.0-2.7.9.6 - Deserialization of Untrusted Data via HikariConfig Gadget
CVSS 9.8
CVE-2020-8441 CRITICAL
jyaml < 1.3 - Remote Code Execution via Untrusted Data Deserialization
CVSS 9.8
CVE-2020-9006 CRITICAL
Popup Builder 2.2.8-2.6.7.6 - SQL Injection via PHP Deserialization in sgImportPopups
CVSS 9.8
CVE-2020-8801 HIGH
SuiteCRM <= 7.11.11 - PHAR Deserialization
CVSS 7.2
CVE-2020-2123 HIGH
Jenkins RadarGun Plugin < 1.7 - Remote Code Execution via YAML Deserialization
CVSS 8.8
CVE-2020-0618 HIGH KEV
Microsoft SQL Server Reporting Services - Remote Code Execution via ViewState Deserialization
CVSS 8.8
CVE-2020-8840 CRITICAL
FasterXML Jackson-Databind <2.9.10.2 - RCE
CVSS 9.8
CVE-2020-6770 CRITICAL
Bosch BVMS Mobile Video Service < 7.5 - Unauthenticated Remote Code Execution via Untrusted Data Deserialization
CVSS 10.0
CVE-2020-3716 CRITICAL
Magento <2.3.3, <2.2.10, <1.14.4.3, <1.9.4.3 - Code Injection
CVSS 9.8
Details
Vulnerabilities 2,842
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits