Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVEs (3,196)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-29615 1Sap 1Netweaver Developer Studio Jun 17, 2026 Jun 14, 2022 N/A· v4 3.4 LOW· v3 3.6 LOW· v2 SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vul...Show more SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x.Show less
CVE-2021-35095 1Qualcomm 10Ar8035 Firmware Qca8081 FirmwareQca8337 Firmware+7 more Jun 17, 2026 Jun 14, 2022 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectivity, Snapdragon Mobile
CVE-2022-25863 1Gatsbyjs 1Gatsby Jun 17, 2026 Jun 10, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that...Show more The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.Show less
CVE-2022-25845 2Alibaba Oracle 2Communications Cloud Native Core Unified Data Repository Fastjson Jun 17, 2026 Jun 10, 2022 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vuln...Show more The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).Show less
CVE-2022-1660 1Keysight 2N6841a Rf Firmware N6854a Firmware Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code.
CVE-2022-29875 1Siemens 18Biograph Horizon Pet/ct Systems Firmware Magnetom Numaris X FirmwareMammomat Revelation Firmware+15 more Jun 17, 2026 Jun 1, 2022 N/A· v4 9.8 CRITICAL· v3 9.3 HIGH· v2 A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC2...Show more A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.Show less
CVE-2021-32935 1Cognex 1In Sight Opc Server Jun 17, 2026 May 23, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalat...Show more The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.Show less
CVE-2022-28948 2Netapp Yaml Project 2Astra Trident Yaml Jun 17, 2026 May 19, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVE-2022-1118 1Rockwellautomation 3Connected Component Workbench Isagraf WorkbenchSafety Instrumented Systems Workstation Jun 17, 2026 May 17, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be des...Show more Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploitedShow less
CVE-2022-24108 1Skyoftech 1So Listing Tabs Jun 17, 2026 May 17, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause Do...Show more The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.Show less
CVE-2022-0573 1Jfrog 1Artifactory Jun 17, 2026 May 16, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a...Show more JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.Show less
CVE-2022-29363 1Phpok 1Phpok Jun 17, 2026 May 12, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php. This vulnerability allows attackers to getshell via writing arbitrary files.
CVE-2022-1463 1Booking Calendar Project 1Booking Calendar Jun 17, 2026 May 10, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above t...Show more The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.Show less
CVE-2021-23592 1Thinkphp 1Thinkphp Jun 17, 2026 May 6, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
CVE-2020-23621 1Squire Technologies 1Svi Ms Management System Jun 17, 2026 May 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute ar...Show more The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.Show less
CVE-2020-23620 1Orlansoft 1Orlansoft Erp Jun 17, 2026 May 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary cod...Show more The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.Show less
CVE-2022-25767 1Ureport2 Project 1Ureport2 Jun 17, 2026 May 1, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.
CVE-2022-25647 4Debian GoogleNetapp+1 more 6Active Iq Unified Manager Debian LinuxFinancial Services Crime And Compliance Management Studio+3 more Jun 17, 2026 May 1, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CVE-2022-29936 1Usu 1Oracle Optimization Jun 17, 2026 Apr 29, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation produ...Show more USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.Show less
CVE-2022-29528 2Misp Misp Project 2Misp Misp Jun 22, 2026 Apr 20, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.

Previous 1...120121122...160 Next