Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVEs (3,540)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-7840 1Adobe 1Coldfusion Jun 17, 2026 Jun 12, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-12760 1Parso Project 1Parso Jun 17, 2026 Jun 6, 2019 N/A· v4 7.5 HIGH· v3 6.0 MEDIUM· v2 A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and th...Show more A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.Show less
CVE-2019-11080 1Sitecore 1Experience Platform Jun 17, 2026 Jun 6, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by s...Show more Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.Show less
CVE-2019-11956 1Hp 1Intelligent Management Center Jun 17, 2026 Jun 5, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11950 1Hp 1Intelligent Management Center Jun 17, 2026 Jun 5, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-5350 1Hp 1Intelligent Management Center Jun 17, 2026 Jun 5, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11945 1Hp 1Intelligent Management Center Jun 17, 2026 Jun 5, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11944 1Hp 1Intelligent Management Center Jun 17, 2026 Jun 5, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-10069 1Godotengine 1Godot Jun 17, 2026 May 31, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
CVE-2019-9875 1Sitecore 1Cms Jun 17, 2026 May 31, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
CVE-2019-9874 1Sitecore 2Cms Experience Platform Jun 17, 2026 May 31, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a s...Show more Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.Show less
CVE-2019-6980 1Synacor 1Zimbra Collaboration Suite Jun 17, 2026 May 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
CVE-2019-7091 1Adobe 1Coldfusion Jun 17, 2026 May 24, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2017-18375 1Ampache 1Ampache Nov 21, 2024 May 24, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.
CVE-2016-10753 1E107 1E107 Nov 21, 2024 May 24, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
CVE-2016-10750 1Hazelcast 1Hazelcast Nov 21, 2024 May 22, 2019 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable cla...Show more In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.Show less
CVE-2019-12241 1Carts.guru 1Carts Guru Jun 17, 2026 May 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
CVE-2019-12240 1Virim Project 1Virim Jun 17, 2026 May 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
CVE-2019-12086 2Debian Fasterxml 2Debian Linux Jackson Databind Oct 8, 2026 May 17, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service h...Show more A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.Show less
CVE-2019-4279 1Ibm 1Websphere Application Server Jun 17, 2026 May 17, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.

Previous 1...163164165...177 Next