CWE-502

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and pa

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the con

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files c

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on sy

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL

An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserializat

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrar

Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve a

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cach

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Stor

An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which

Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticat

An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remo

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX ev

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unaut

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a D

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authe

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentic

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Pla

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized a

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Plat

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow

rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows re

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentic

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause

IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary com

Microsoft SharePoint Remote Code Execution Vulnerability

Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote u

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated u

DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.

The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unseria

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.1

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to e