VYPR

CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (1,721)

page 72 of 87
  • CVE-2024-23636Jan 23, 2024
    risk 0.00cvss —epss 0.01

    SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to…

  • CVE-2017-20189Jan 22, 2024
    risk 0.00cvss —epss 0.01

    In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

  • CVE-2024-23730Jan 21, 2024
    risk 0.00cvss —epss 0.01

    The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.

  • CVE-2023-51785Jan 3, 2024
    Apache
    InLong
    risk 0.00cvss —epss 0.01

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to…

  • CVE-2023-51656Dec 21, 2023
    risk 0.00cvss —epss 0.01

    Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

  • CVE-2023-7018Dec 20, 2023
    risk 0.00cvss —epss 0.01

    Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

  • CVE-2023-6730Dec 19, 2023
    risk 0.00cvss —epss 0.01

    Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

  • CVE-2023-46279Dec 15, 2023
    risk 0.00cvss —epss 0.02

    Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.

  • CVE-2023-6654Dec 10, 2023
    Phpems
    Phpems
    risk 0.00cvss —epss 0.02

    A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched…

  • CVE-2023-49297Dec 5, 2023
    Iterative
    PyDrive2
    risk 0.00cvss —epss 0.01

    PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same…

  • CVE-2023-46674Dec 5, 2023
    Elastic
    Elasticsearch
    risk 0.00cvss —epss 0.00

    An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

  • CVE-2023-48967Dec 4, 2023
    risk 0.00cvss —epss 0.01

    Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.

  • CVE-2023-48887Dec 1, 2023
    risk 0.00cvss —epss 0.02

    A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.

  • CVE-2023-6378Nov 29, 2023
    risk 0.00cvss —epss 0.01

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

  • CVE-2022-41678Nov 28, 2023
    Apache
    Activemq
    risk 0.00cvss —epss 0.86

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able…

  • CVE-2023-46302Nov 20, 2023
    risk 0.00cvss —epss 0.02

    Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (using application/yaml…

  • CVE-2023-47130Nov 14, 2023
    risk 0.00cvss —epss 0.03

    Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been…

  • CVE-2023-47248Nov 9, 2023
    Apache
    PyArrow
    risk 0.00cvss —epss 0.14

    Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This…

  • CVE-2023-39913Nov 8, 2023
    Apache
    UIMA Java SDK
    risk 0.00cvss —epss 0.01

    Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0. Users are recommended to upgrade to version 3.5.0, which…

  • CVE-2023-47204Nov 2, 2023
    risk 0.00cvss —epss 0.01

    Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.