CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2024-50416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-28T12:15:15Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through 1.2.6.",
  "id": "GHSA-2wqh-23wf-9qr9",
  "modified": "2026-04-01T18:32:10Z",
  "published": "2024-10-28T12:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50416"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wpc-shop-as-customer/vulnerability/wordpress-wpc-shop-as-a-customer-for-woocommerce-plugin-1-2-6-php-object-injection-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wpc-shop-as-customer/wordpress-wpc-shop-as-a-customer-for-woocommerce-plugin-1-2-6-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-10289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-20T08:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib, an attacker with local or remote access can make the ROS Master, execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.",
  "id": "GHSA-2x5j-2j53-xffv",
  "modified": "2022-05-24T17:26:12Z",
  "published": "2022-05-24T17:26:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10289"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ros/actionlib/pull/171"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00055.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-30899"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-09T13:15:18Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in Siveillance Video 2020 R2 (All versions \u003c V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions \u003c V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions \u003c V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions \u003c V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions \u003c V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions \u003c V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions \u003c V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions \u003c V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.",
  "id": "GHSA-2x6m-x5h6-g6v8",
  "modified": "2024-04-04T03:55:24Z",
  "published": "2023-05-09T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30899"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-rabbitmq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.25.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-rabbitmq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-11972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T19:01:28Z",
    "nvd_published_at": "2020-05-14T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.",
  "id": "GHSA-2x6r-7427-95cm",
  "modified": "2021-05-21T19:01:28Z",
  "published": "2021-05-21T19:20:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11972"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2020-11972.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/05/14/10"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/05/14/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in Apache Camel RabbitMQ"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-23T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class.",
  "id": "GHSA-2x7q-53h6-xvhj",
  "modified": "2022-05-13T01:50:52Z",
  "published": "2022-05-13T01:50:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19499"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/407552"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-18T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter.",
  "id": "GHSA-2xp2-6xw3-mw59",
  "modified": "2022-05-24T17:42:38Z",
  "published": "2022-05-24T17:42:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27335"
    },
    {
      "type": "WEB",
      "url": "https://hacked0x90.net/index.php/2021/02/15/kollectapp-insecure-java-deserialization"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-3374"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-31T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.",
  "id": "GHSA-2xq6-mr97-65fj",
  "modified": "2022-11-01T19:00:31Z",
  "published": "2022-10-31T19:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3374"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-27414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T12:17:00Z",
    "severity": "HIGH"
  },
  "details": "Contributor PHP Object Injection in Werkstatt \u003c= 4.8.3 versions.",
  "id": "GHSA-3236-q4rc-wfw4",
  "modified": "2026-07-02T12:31:00Z",
  "published": "2026-07-02T12:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27414"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-8-3-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:yaml-axis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-2179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-16T23:00:17Z",
    "nvd_published_at": "2020-04-16T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a multi-configuration (Matrix) job, or control the contents of a previously configured job\u2019s SCM repository.\n\nYaml Axis Plugin 0.2.1 configures its YAML parser to only instantiate safe types.",
  "id": "GHSA-324h-2v7h-q3xx",
  "modified": "2023-12-22T13:54:14Z",
  "published": "2022-05-24T17:15:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/yaml-axis-plugin/commit/346802860c68a5a9bb4996c81fed4e05bee594f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/yaml-axis-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1825"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/04/16/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RCE vulnerability in Jenkins Yaml Axis Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-18580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-26T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.",
  "id": "GHSA-32f2-chgf-rf94",
  "modified": "2024-04-04T02:40:58Z",
  "published": "2022-05-24T17:02:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18580"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/security/en-us/details/538977/DSA-2019-176-Dell-EMC-Storage-Monitoring-and-Reporting-SMR-Java-RMI-Deserialization-of-Untruste"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}