1208
Observed Examples
Reference Description
CVE-2019-12799 chain: bypass of untrusted deserialization issue (CWE-502) by using an
assumed-trusted class (CWE-183)
https://www.cve.org/CVERecord?id=CVE-2019-12799
CVE-2015-8103 Deserialization issue in commonly-used Java library allows remote execution.
https://www.cve.org/CVERecord?id=CVE-2015-8103
CVE-2015-4852 Deserialization issue in commonly-used Java library allows remote execution.
https://www.cve.org/CVERecord?id=CVE-2015-4852
CVE-2013-1465 Use of PHP unserialize function on untrusted input allows attacker to modify
application configuration.
https://www.cve.org/CVERecord?id=CVE-2013-1465
CVE-2012-3527 Use of PHP unserialize function on untrusted input in content management
system might allow code execution.
https://www.cve.org/CVERecord?id=CVE-2012-3527
CVE-2012-0911 Use of PHP unserialize function on untrusted input in content management
system allows code execution using a crafted cookie value.
https://www.cve.org/CVERecord?id=CVE-2012-0911
CVE-2012-0911 Content management system written in PHP allows unserialize of arbitrary
objects, possibly allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2012-0911
CVE-2011-2520 Python script allows local users to execute code via pickled data.
https://www.cve.org/CVERecord?id=CVE-2011-2520
CVE-2012-4406 Unsafe deserialization using pickle in a Python script.
https://www.cve.org/CVERecord?id=CVE-2012-4406
CVE-2003-0791 Web browser allows execution of native methods via a crafted string to a
JavaScript function that deserializes the string.
https://www.cve.org/CVERecord?id=CVE-2003-0791
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 858 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 15 - Serialization (SER)
844 2368
MemberOf 884 CWE Cross-section 884 2567
MemberOf 994 SFP Secondary Cluster: Tainted Input to Variable 888 2417
MemberOf 1034 OWASP Top Ten 2017 Category A8 - Insecure
Deserialization
1026 2438
MemberOf 1148 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 14. Serialization (SER)
1133 2451
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
CWE Version 4.14
CWE-502: Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data