Weaknesses of type CWE-502

3,028 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2023-0669HIGHFortra GoAnywhere MFT License Response Servlet Command InjectionEPSS 100.0%KEVCVE-2021-35464CRITICALForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitatioEPSS 100.0%KEVCVE-2025-53770CRITICALMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-44228CRITICALApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsEPSS 100.0%KEVCVE-2023-46604CRITICALApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackEPSS 100.0%KEVCVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2025-59287CRITICALWindows Server Update Service (WSUS) Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-47986CRITICALIBM Aspera Faspex code executionEPSS 100.0%KEVCVE-2018-2628CRITICALVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions thEPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2020-10189CRITICALZoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImageEPSS 99.9%KEVCVE-2020-7961CRITICALDeserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web serEPSS 99.9%KEVCVE-2022-35405CRITICALZoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This alEPSS 99.9%KEVCVE-2025-10035CRITICALDeserialization Vulnerability in GoAnywhere MFT's License ServletEPSS 99.8%KEVCVE-2019-18935CRITICALProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This EPSS 99.7%KEVCVE-2025-55182CRITICALA pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 incluEPSS 99.7%KEVCVE-2023-27372CRITICALSPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions arEPSS 99.7%CVE-2017-1000353CRITICALJenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthentEPSS 99.7%KEVCVE-2025-49113CRITICALRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aEPSS 99.6%KEV