CWE-502— Deserialization of Untrusted Data

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls ba…

Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.

Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableT…

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of t…

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an a…

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cac…

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cas…

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a …

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.