CWE-502

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.parquet:parquet-avro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30065"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-01T18:04:17Z",
    "nvd_published_at": "2025-04-01T08:15:15Z",
    "severity": "CRITICAL"
  },
  "details": "Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code\n\n\nUsers are recommended to upgrade to version 1.15.1, which fixes the issue.",
  "id": "GHSA-2c59-37c4-qrx5",
  "modified": "2025-05-07T17:39:39Z",
  "published": "2025-04-01T09:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30065"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/parquet-java/issues/3168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/parquet-java/pull/3169"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-30065"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/parquet-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/AVRO-3985"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=43603091"
    },
    {
      "type": "WEB",
      "url": "https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/04/01/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-0147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-08T07:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.",
  "id": "GHSA-2ccw-7gjg-m467",
  "modified": "2025-10-22T00:31:30Z",
  "published": "2022-05-13T01:17:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0147"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0147"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103328"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040463"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-02T15:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  236069.",
  "id": "GHSA-2cf4-9q4p-f6wj",
  "modified": "2024-04-04T06:29:45Z",
  "published": "2023-08-02T15:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40609"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/236069"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7017032"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-32601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-08T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319132; Issue ID: ALPS07319132.",
  "id": "GHSA-2cfx-8j9j-pg36",
  "modified": "2022-11-09T19:02:22Z",
  "published": "2022-11-09T12:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32601"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/November-2022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-22T12:29:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999.",
  "id": "GHSA-2cm6-r3gm-8w87",
  "modified": "2022-05-14T03:14:51Z",
  "published": "2022-05-14T03:14:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1677"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/133999"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22012896"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103422"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041227"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-33243"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T14:16:03Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.",
  "id": "GHSA-2cpx-h862-rqm6",
  "modified": "2026-02-18T15:31:25Z",
  "published": "2026-02-18T15:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33243"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5762"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33243"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.0.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.openidentityplatform.openam:openam"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-07T15:45:50Z",
    "nvd_published_at": "2026-04-07T21:17:17Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nOpenIdentityPlatform OpenAM 16.0.5 (and likely earlier versions) is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the `jato.clientSession` HTTP parameter. This bypasses the `WhitelistObjectInputStream` mitigation that was applied to the `jato.pageSession` parameter after CVE-2021-35464.\n\nAn unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the `jato.clientSession` GET/POST parameter to any JATO ViewBean endpoint whose JSP contains `\u003cjato:form\u003e` tags (e.g., the Password Reset pages).\n\n---\n\n## Vulnerability Details\n\n### Background\n\nCVE-2021-35464 identified that the `jato.pageSession` HTTP parameter was deserialized without class filtering, allowing pre-auth RCE.\n\nOpenIdentityPlatform OpenAM mitigated this by introducing `WhitelistObjectInputStream` in `ConsoleViewBeanBase.deserializePageAttributes()`, which restricts `jato.pageSession` deserialization to a hardcoded whitelist of ~40 safe classes.\n\nHowever, the JATO framework contains a **second deserialization entry point** \u2014 `jato.clientSession` \u2014 handled by `ClientSession.deserializeAttributes()`. This code path was **not patched** and still uses the unfiltered `Encoder.deserialize()` \u2192 `ApplicationObjectInputStream`, which performs `ObjectInputStream.readObject()` with no class whitelist.\n\n### Root Cause\n\n```\nClientSession.deserializeAttributes()\n  \u2192 Encoder.deserialize()\n    \u2192 ApplicationObjectInputStream.readObject()  // VULNERABLE \u2014 no whitelist\n```\n\nThe `ClientSession` object is instantiated in `RequestContextImpl.getClientSession()` with the raw `jato.clientSession` parameter value from the HTTP request. Deserialization is triggered during JSP rendering when `\u003cjato:form\u003e` tags invoke `getClientSession()` \u2192 `hasAttributes()` \u2192 `getEncodedString()` \u2192 `isValid()` \u2192 `ensureAttributes()` \u2192 `deserializeAttributes()`.\n\n### Affected Code\n\n**File:** `com/iplanet/jato/ClientSession.java`\n```java\nprotected ClientSession(RequestContext context) {\n    this.encodedSessionString =\n        context.getRequest().getParameter(\"jato.clientSession\");\n}\n\nprotected void deserializeAttributes() {\n    if (this.encodedSessionString != null\n        \u0026\u0026 this.encodedSessionString.trim().length() \u003e 0) {\n        this.setAttributes(\n            (Map) Encoder.deserialize(\n                Encoder.decodeHttp64(this.encodedSessionString), false)\n        );\n    }\n}\n```\n\n### Gadget Chain\n\nThe exploit uses classes bundled in the OpenAM WAR:\n\n```\nPriorityQueue.readObject()                        [java.util \u2014 JDK]\n  \u2192 heapify() \u2192 siftDown() \u2192 comparator.compare()\n    \u2192 Column$ColumnComparator.compare()            [openam-core-16.0.5.jar]\n      \u2192 Column.getProperty()\n        \u2192 PropertyUtils.getObjectPropertyValue()   [openam-core-16.0.5.jar]\n          \u2192 Method.invoke(TemplatesImpl, \"getOutputProperties\")\n            \u2192 TemplatesImpl.getOutputProperties()  [xalan-2.7.3.jar]\n              \u2192 newTransformer() \u2192 defineTransletClasses()\n                \u2192 TransletClassLoader.defineClass(_bytecodes)\n                  \u2192 _class[_transletIndex].newInstance()\n                    \u2192 EvilTranslet.\u003cclinit\u003e()      [attacker bytecode]\n                      \u2192 Runtime.getRuntime().exec(cmd)\n```\n\n---\n\n## Impact\n\n- **Pre-authentication** \u2014 no credentials or session tokens required\n- **Remote Code Execution** \u2014 arbitrary OS commands as the application server user\n- Full server compromise, lateral movement, data exfiltration\n- Affects any deployment with at least one accessible JATO endpoint whose JSP renders `\u003cjato:form\u003e` tags (e.g., Password Reset pages)\n\n---\n\n## Tested Environment\n\n- OpenIdentityPlatform OpenAM 16.0.5 (official release WAR from GitHub)\n- Apache Tomcat 10.1.52\n- Java 21.0.7 (Oracle JDK)\n- macOS / Linux (aarch64)\n- Also verified on `openidentityplatform/openam:latest` Docker image (Java 25)\n\n## Affected Versions\n\n- OpenIdentityPlatform OpenAM 16.0.5 (confirmed on both Docker and bare-metal Tomcat)\n- Likely all versions that left `ClientSession.deserializeAttributes()` unpatched\n\n---\n\n## Remediation\n\n1. Apply `WhitelistObjectInputStream` filtering to `ClientSession.deserializeAttributes()`, matching the mitigation already applied to `ConsoleViewBeanBase.deserializePageAttributes()`\n2. Audit all callers of `Encoder.deserialize()` for user-controlled input\n3. Consider adding a JVM-wide JEP 290 deserialization filter as defense-in-depth\n\n---\n\n## References\n\n- CVE-2021-35464 \u2014 Pre-auth RCE in ForgeRock OpenAM (PortSwigger Research)\n- https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464\n- CWE-502: Deserialization of Untrusted Data\n\n---\n\n## Credit\n\nThis finding was discovered by **Rahul Maini and Hacktron AI** while auditing OpenIdentityPlatform OpenAM. Hacktron AI is our white-box pentest solution, designed to deliver high-accuracy results with minimal false positives.\n\n---\n\n## Disclosure Policy\n\nThis bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public on the day that the fix was made available or an earlier or later date if agreed by both parties. Otherwise, this bug report will become public at the deadline.\n\nIf another researcher discloses the proof-of-concept before any deadlines, we reserve the right to publish our findings.\n\nThe details of this bug may be privately disclosed to vulnerable parties, including but not limited to Hacktron AI\u0027s customers.",
  "id": "GHSA-2cqq-rpvq-g5qj",
  "modified": "2026-04-07T22:16:49Z",
  "published": "2026-04-07T15:45:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/014007c63cacc834cc795a89fac0e611aebc4a32"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.0.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-53584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-28T13:16:05Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software \u0026 Support Ticket System allows Object Injection. This issue affects WP Ticket Customer Service Software \u0026 Support Ticket System: from n/a through 6.0.2.",
  "id": "GHSA-2cv8-4fc6-53r9",
  "modified": "2026-04-01T18:36:01Z",
  "published": "2025-08-28T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53584"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-ticket/vulnerability/wordpress-wp-ticket-customer-service-software-support-ticket-system-plugin-6-0-2-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-04T18:15:46Z",
    "severity": "HIGH"
  },
  "details": "In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-2cvj-3458-7wc9",
  "modified": "2025-09-05T18:31:18Z",
  "published": "2025-09-05T18:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32312"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/frameworks/base/+/577cdba1048ce04816c962264a11efd02f1f5b73"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2025-06-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-39636"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-01T22:15:25Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.",
  "id": "GHSA-2f23-9vw3-564h",
  "modified": "2024-08-02T00:31:25Z",
  "published": "2024-08-02T00:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39636"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/real-time-auto-find-and-replace/wordpress-better-find-and-replace-plugin-1-6-1-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}