CWE-502— Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog
3,475 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-502page 53 of 70
- CVE-2023-3001HIGHCVSS 7.8EG 7.82023-06-14
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a …
- CVE-2022-37378HIGHCVSS 7.8EG 7.82023-03-29
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or o…
- CVE-2022-2561HIGHCVSS 7.8EG 7.82023-03-29
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OPC Labs QuickOPC 2022.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…
- CVE-2022-28685HIGHCVSS 7.8EG 7.82023-03-29
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a …
- CVE-2023-26547HIGHCVSS 7.8EG 7.82023-03-27
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- CVE-2023-1145HIGHCVSS 7.8EG 7.82023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resu…
- CVE-2023-27978HIGHCVSS 7.8EG 7.82023-03-21
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a m…
- CVE-2023-20944HIGHCVSS 7.8EG 7.82023-02-28
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
- CVE-2023-21779HIGHCVSS 7.8EG 7.82023-01-10
Visual Studio Code Remote Code Execution Vulnerability
- CVE-2022-32601HIGHCVSS 7.8EG 7.82022-11-08
In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID…
- CVE-2022-42919HIGHCVSS 7.8EG 7.82022-11-07
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be de…
- CVE-2022-26472HIGHCVSS 7.8EG 7.82022-10-07
In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID…
- CVE-2022-26471HIGHCVSS 7.8EG 7.82022-10-07
In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Pa…
- CVE-2022-35872HIGHCVSS 7.8EG 7.82022-07-25
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit …
- CVE-2022-33320HIGHCVSS 7.8EG 7.82022-07-20
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97…
- CVE-2022-33316HIGHCVSS 7.8EG 7.82022-07-20
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97…
- CVE-2022-33315HIGHCVSS 7.8EG 7.82022-07-20
Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97…
- CVE-2022-27580HIGHCVSS 7.8EG 7.82022-07-19
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious proj…
- CVE-2022-27579HIGHCVSS 7.8EG 7.82022-07-19
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a mali…
- CVE-2021-36665HIGHCVSS 7.8EG 7.82022-07-12
An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon.
- CVE-2021-21956HIGHCVSS 7.8EG 7.82022-04-14
A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potential arbitrary command execution. An attacker can provide a malicious file to tri…
- CVE-2022-26503HIGHCVSS 7.8EG 7.82022-03-17
Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.
- CVE-2021-46364HIGHCVSS 7.8EG 7.82022-02-11
A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
- CVE-2021-39676HIGHCVSS 7.8EG 7.82022-02-11
In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. U…
- CVE-2021-4118HIGHCVSS 7.8EG 7.82021-12-23
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
- CVE-2021-0970HIGHCVSS 7.8EG 7.82021-12-15
In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…
- CVE-2021-0928HIGHCVSS 7.8EG 7.82021-12-15
In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges n…
- CVE-2021-42698HIGHCVSS 7.8EG 7.82021-11-05
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corru…
- CVE-2021-41078HIGHCVSS 7.8EG 7.82021-10-26
Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.
- CVE-2021-0685HIGHCVSS 7.8EG 7.82021-10-06
In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed.…
- CVE-2021-32568HIGHCVSS 7.8EG 7.82021-09-06
mrdoc is vulnerable to Deserialization of Untrusted Data
- CVE-2021-21869HIGHCVSS 7.8EG 7.82021-08-25
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution…
- CVE-2021-21868HIGHCVSS 7.8EG 7.82021-08-18
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execut…
- CVE-2021-21867HIGHCVSS 7.8EG 7.82021-08-18
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command exe…
- CVE-2021-21863HIGHCVSS 7.8EG 7.82021-08-05
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacke…
- CVE-2021-21866HIGHCVSS 7.8EG 7.82021-08-02
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command exe…
- CVE-2021-21865HIGHCVSS 7.8EG 7.82021-08-02
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An at…
- CVE-2021-21864HIGHCVSS 7.8EG 7.82021-08-02
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command …
- CVE-2021-22777HIGHCVSS 7.8EG 7.82021-07-21
A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.
- CVE-2021-35196HIGHCVSS 7.8EG 7.82021-06-21
Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's p…
- CVE-2021-27277HIGHCVSS 7.8EG 7.82021-04-22
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target sy…
- CVE-2021-27240HIGHCVSS 7.8EG 7.82021-03-29
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to expl…
- CVE-2021-25758HIGHCVSS 7.8EG 7.82021-02-03
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.
- CVE-2020-10721HIGHCVSS 7.8EG 7.82020-10-22
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserializatio…
- CVE-2020-7532HIGHCVSS 7.8EG 7.82020-09-16
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could allow arbitrary code execution when an attacker builds a custom .SDB file containing a malicious serial…
- CVE-2020-7528HIGHCVSS 7.8EG 7.82020-09-16
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code execution when an attacker builds a custom .PRJ file containing a malicious serialized …
- CVE-2020-24164HIGHCVSS 7.8EG 7.82020-09-11
A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because t…
- CVE-2020-15777HIGHCVSS 7.8EG 7.82020-08-25
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker t…
- CVE-2020-0082HIGHCVSS 7.8EG 7.82020-04-17
In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local escalation of privilege to system_server with no additional execution privileges …
- CVE-2019-17635HIGHCVSS 7.8EG 7.82020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose…
Map vulnerabilities like CWE-502 to your infrastructure
EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →