CWE-502

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, wil

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabi

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabi

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabi

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Task

The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.

Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not exp

Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deser

Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java dese

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities

An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache X

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserializa

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for wh

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apac

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups funct

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserializa

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymor

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit poly

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d

In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS com

In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platfor

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknow

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification o

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.

The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of