CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2021-0970"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-15T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196970023",
  "id": "GHSA-2rmc-v2mp-gxq4",
  "modified": "2021-12-18T00:01:30Z",
  "published": "2021-12-16T00:01:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0970"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2021-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-03T09:15:06Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Tunis Soft \"Product Designer\" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.",
  "id": "GHSA-2rpq-p6fh-7mx6",
  "modified": "2024-07-03T18:33:35Z",
  "published": "2024-03-03T09:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24302"
    },
    {
      "type": "WEB",
      "url": "https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-productdesigner-502.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-107104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-07T09:17:05Z",
    "severity": "CRITICAL"
  },
  "details": "This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. \n\nSuccessful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.",
  "id": "GHSA-2v3v-q9xj-82fm",
  "modified": "2026-10-07T09:32:20Z",
  "published": "2026-10-07T09:32:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107104"
    },
    {
      "type": "WEB",
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0430"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.xuxueli:xxl-job-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-3366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-08T15:42:15Z",
    "nvd_published_at": "2024-04-06T11:15:08Z",
    "severity": "LOW"
  },
  "details": "A vulnerability classified as problematic was found in Xuxueli xxl-job version 2.4.0. This vulnerability affects the function `deserialize` of the file `com/xxl/job/core/util/JdkSerializeTool.java` of the component `Template Handler`. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.",
  "id": "GHSA-2v42-xp3j-47m4",
  "modified": "2025-05-23T18:32:28Z",
  "published": "2024-04-06T12:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/issues/3391"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/commit/e3b2e1234614195390f46e26c15cd4881bd4dbe3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xuxueli/xxl-job"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/blob/761de38a0b2a39706e2008e7914fba13bf4ca184/xxl-job-core/src/main/java/com/xxl/job/core/util/JdkSerializeTool.java#L4"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.259480"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.259480"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.308180"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Xuxueli xxl-job template injection vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3699"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-15T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "eDeploy has RCE via cPickle deserialization of untrusted data",
  "id": "GHSA-2vfh-w2hp-mr2m",
  "modified": "2024-04-03T23:59:53Z",
  "published": "2022-05-17T19:57:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3699"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2014-3699"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3699"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-3699"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-9363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-02T05:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.",
  "id": "GHSA-2vfp-x8jm-58cj",
  "modified": "2025-04-20T03:38:24Z",
  "published": "2022-05-17T02:42:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9363"
    },
    {
      "type": "WEB",
      "url": "http://www.soffid.com/security-advisory1-update"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-56037"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T12:17:34Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection.\n\nThis issue affects Themify Popup: from n/a through 1.4.3.",
  "id": "GHSA-2vg7-9fw4-fmph",
  "modified": "2026-07-02T12:31:00Z",
  "published": "2026-07-02T12:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56037"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/themify-popup/vulnerability/wordpress-themify-popup-plugin-1-4-3-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lmdeploy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.2"
            },
            {
              "fixed": "0.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:03:56Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nLMDeploy\u0027s PyTorch DistServe/PD-disaggregation control plane used\n`recv_pyobj()` to deserialize messages received through a ZeroMQ PULL\nsocket. PyZMQ implements `recv_pyobj()` using Python pickle\ndeserialization, which can execute arbitrary code while reconstructing\nan object.\n\nThe peer address used by the receiver was supplied through the\n`POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach\nan affected DistServe API server could cause the server to connect to an\nattacker-controlled ZeroMQ endpoint and deserialize a crafted pickle\npayload.\n\nAPI-key authentication is not enabled unless the operator explicitly\nconfigures it. As a result, affected DistServe deployments without API\nkeys allowed unauthenticated remote code execution with the privileges\nof the LMDeploy serving process.\n\nThis issue affects the PyTorch backend when PD-disaggregation/DistServe\nis enabled. Ordinary deployments that do not use the affected\ndisaggregated-serving path do not expose this data flow.\n\n## Affected components\n\n- HTTP entry point:\n  `lmdeploy/serve/openai/endpoints/distserve.py`,\n  `POST /distserve/p2p_connect`\n- Attacker-controlled peer address:\n  `DistServeConnectionRequest.remote_engine_endpoint_info.zmq_address`\n- Vulnerable receiver:\n  `lmdeploy/pytorch/disagg/conn/engine_conn.py`,\n  `EngineP2PConnection.handle_zmq_recv()`\n- Unsafe operation: `recv_pyobj()`, which performs pickle deserialization\n\n## Vulnerable data flow\n\n1. A caller submits a DistServe P2P connection request containing a\n   ZeroMQ address.\n2. The LMDeploy engine connects its ZeroMQ PULL socket to that address.\n3. `handle_zmq_recv()` receives messages using `recv_pyobj()`.\n4. A malicious peer sends a crafted pickle object.\n5. Python code executes during deserialization, before LMDeploy can\n   perform any type or field validation.\n\n  A type check performed after `recv_pyobj()` cannot mitigate this issue\n  because pickle payload execution occurs during deserialization.\n\n## Impact\n\nSuccessful exploitation allows arbitrary code execution as the\nLMDeploy serving process. This can expose model weights, prompts,\ncredentials, attached storage, cluster-network services, and host or\nGPU resources. An attacker may also modify or terminate the serving\nprocess.\n\n## Affected versions\n\nAffected versions:\n\n- `lmdeploy \u003e= 0.9.2, \u003c 0.16.0`\n\nThe vulnerable P2P receiver was introduced in commit `b0b705f7`.\n\n## Remediation\n\nThe issue was fixed by replacing the pickle-based ZeroMQ protocol with\nJSON serialization:\n\n- `send_pyobj()` was replaced with `send_json()`.\n- `recv_pyobj()` was replaced with `recv_json()`.\n- Received objects are validated using the\n  `DistServeCacheFreeRequest` Pydantic schema before use.\n- Invalid or off-schema messages are rejected without terminating the\n  receive loop.\n\nFix commit:\n\nhttps://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2\n\nThe fix was released in LMDeploy 0.16.0.\n\n## Workarounds\n\nUsers who cannot upgrade immediately should:\n\n- Prevent untrusted clients from reaching `/distserve/*` endpoints.\n- Restrict the DistServe HTTP and ZeroMQ control planes to trusted\n  cluster networks.\n- Configure API-key authentication.\n- Block arbitrary outbound ZeroMQ connections from serving nodes.\n\nThese measures reduce exposure but do not make pickle deserialization\nsafe. Upgrading to LMDeploy 0.16.0 or later is recommended.",
  "id": "GHSA-2vh9-42vm-xmv2",
  "modified": "2026-09-18T17:03:56Z",
  "published": "2026-09-18T17:03:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/InternLM/lmdeploy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LMDeploy has Remote Code Execution\u00a0by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-9061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-26T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the \"install module\" feature.",
  "id": "GHSA-2vhf-f8q9-6wxf",
  "modified": "2022-05-13T01:22:59Z",
  "published": "2022-05-13T01:22:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9061"
    },
    {
      "type": "WEB",
      "url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
    },
    {
      "type": "WEB",
      "url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pytorch-lightning"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4118"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-05T17:49:21Z",
    "nvd_published_at": "2021-12-23T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "pytorch-lightning is vulnerable to Deserialization of Untrusted Data.",
  "id": "GHSA-2vj5-px25-gjrp",
  "modified": "2024-10-25T20:50:29Z",
  "published": "2022-01-06T23:58:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4118"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PyTorchLightning/pytorch-lightning/issues/11045"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PyTorchLightning/pytorch-lightning/pull/11099"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34ace"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PyTorchLightning/pytorch-lightning/releases/tag/1.6.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2vj5-px25-gjrp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2021-874.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pytorchlightning/pytorch-lightning"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pytorch-lightning is vulnerable to Deserialization of Untrusted Data"
}