CWE-502

An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execut

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thro

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in

NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remot

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attacke

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earl

In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serializ

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior o

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Ec

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a

A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products

* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated i

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operation

A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthentic

Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial

The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacke

ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application cra

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can c

IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes th

IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the s

Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJ

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possibl

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects p

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a rea

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying

A potential Remote Arbitrary Code Execution vulnerability has been identified in Micro Focus' Real User Monitoring softw

Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes t

It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained ma

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized objec

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() f

IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sourc

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies relate

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing unt

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver compon

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialize

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists bec

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer,

The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute a