#cwe-502

共收录 945 条相关情报。

← 返回所有主题
漏洞预警2026-04-27 发布INFO

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname...

CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types)

历史摘要 · 未重新核验 · NVD

漏洞预警2026-04-27 发布INFO

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.Obje...

CVE-2026-40860

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payloa

历史摘要 · 未重新核验 · NVD

漏洞预警2026-04-27 发布INFO

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-...

CVE-2026-40473

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInp

历史摘要 · 未重新核验 · NVD

漏洞预警2026-04-27 发布INFO

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applyin...

CVE-2026-40048

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directo

历史摘要 · 未重新核验 · NVD

漏洞预警2025-06-20 发布INFO

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the...

CVE-2025-25034

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0

来源摘录 · NVD