Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVEs (2,964)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-14035 1Crushftp 1Crushftp May 13, 2026 Aug 30, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
CVE-2017-11153 1Synology 1Photo Station May 13, 2026 Aug 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
CVE-2017-9785 1Nancyfx 1Nancy May 13, 2026 Jul 20, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.
CVE-2017-1000053 1Plug Project 1Plug May 13, 2026 Jul 17, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
CVE-2017-1000034 1Akka 1Akka May 13, 2026 Jul 17, 2017 N/A· v4 8.1 HIGH· v3 9.3 HIGH· v2 Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
CVE-2016-6793 1Apache 1Wicket May 13, 2026 Jul 17, 2017 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFile...Show more The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.Show less
CVE-2017-9844 1Sap 1Netweaver May 2, 2025 Jul 12, 2017 N/A· v4 7.5 HIGH· v3 7.5 HIGH· v2 SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804...Show more SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.Show less
CVE-2017-11143 1Php 1Php May 13, 2026 Jul 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an em...Show more In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.Show less
CVE-2016-4000 2Debian Jython Project 2Debian Linux Jython May 13, 2026 Jul 6, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
CVE-2017-2295 2Debian Puppet 2Debian Linux Puppet May 13, 2026 Jul 5, 2017 N/A· v4 8.2 HIGH· v3 6.0 MEDIUM· v2 Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, w...Show more Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.Show less
CVE-2017-10803 1Odoo 1Odoo May 13, 2026 Jul 4, 2017 N/A· v4 6.5 MEDIUM· v3 8.5 HIGH· v2 In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to exe...Show more In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.Show less
CVE-2017-2292 1Puppet 1Mcollective May 13, 2026 Jun 30, 2017 N/A· v4 9.0 CRITICAL· v3 7.5 HIGH· v2 Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. Thi...Show more Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.Show less
CVE-2017-9830 1Code42 1Crashplan May 13, 2026 Jun 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects...Show more Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.Show less
CVE-2017-9424 1Ideablade 1Breeze.server.net May 13, 2026 Jun 22, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.
CVE-2016-7050 1Redhat 4Enterprise Linux Desktop Enterprise Linux Hpc NodeEnterprise Linux Server+1 more May 13, 2026 Jun 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execut...Show more SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.Show less
CVE-2016-3690 1Redhat 1Jboss Enterprise Application Platform May 13, 2026 Jun 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
CVE-2017-5878 1Red5 1Media Server May 13, 2026 Jun 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
CVE-2017-4914 1Vmware 1Vsphere Data Protection May 13, 2026 Jun 7, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
CVE-2017-9363 1Soffid 1Iam May 13, 2026 Jun 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.
CVE-2017-7504 1Redhat 1Jboss Enterprise Application Platform May 13, 2026 May 19, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs d...Show more HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.Show less

Previous 1...145146147 148 149 Next