Weaknesses of type CWE-502

2,657 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2025-49113CRITICALRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aEPSS 98.9%KEVCVE-2018-1000861CRITICALA code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/corEPSS 98.3%KEVCVE-2021-39144HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 98.1%KEVCVE-2015-7450CRITICALSerialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products alloEPSS 97.8%KEVCVE-2021-42237CRITICALSitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achiEPSS 97.6%KEVCVE-2020-2555CRITICALVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions thaEPSS 97.1%KEVCVE-2023-38203CRITICALAnalysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEEPSS 97.1%KEVCVE-2025-5086CRITICALDeserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 96.9%KEVCVE-2015-4852CRITICALThe WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitraryEPSS 96.0%KEVCVE-2023-25194HIGHApache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect EPSS 95.8%CVE-2021-26857HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 95.8%KEVCVE-2019-10068CRITICALAn issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure tEPSS 95.1%KEVCVE-2021-31474CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 202EPSS 93.9%CVE-2025-24016CRITICALRemote code execution in Wazuh serverEPSS 93.8%KEVCVE-2021-27850—Bypass of the fix for CVE-2019-0195EPSS 93.5%CVE-2024-0692HIGHSolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 92.2%CVE-2019-6340HIGHDrupal core - Highly critical - Remote Code ExecutionEPSS 92.0%KEVCVE-2017-12149CRITICALIn Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnEPSS 90.7%KEVCVE-2017-3066CRITICALAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializaEPSS 90.6%KEVCVE-2024-40711CRITICALA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).EPSS 90.4%KEV