CWE-502

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Se

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to e

Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of

H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulner

Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote C

Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of unt

The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vuln

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async,

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to

A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifa

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Wo

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & A

Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application i

Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a thr

Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a thr

Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP:

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions

Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnail

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenti

In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible

Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe

In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con

Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary

The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which coul

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserial

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the sys

Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" paramete

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vul

Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse ym

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserial

An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the

An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing ar

nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via uns

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote atta

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users

Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary comman

Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability

Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.