CWE-502

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many admin

MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewri

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device ve

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeseriali

The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will c

This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the

A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary cod

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config whic

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connec

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SIN

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' val

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via th

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which

The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP obj

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP obje

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lea

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. D

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a mu

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on

Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and

Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.

A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attac

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vul

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializati

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

In the keystore library, there is a possible prevention of access to system Settings due to unsafe deserialization. This

A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipu

This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Acces

A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The

PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supp

SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lea

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS

Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote