Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2018-7529—A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modifEPSS 2.1%CVE-2025-55232CRITICALMicrosoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-62204HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-43019CRITICALOpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.EPSS 2.1%CVE-2025-29953CRITICALApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassEPSS 2.1%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.1%CVE-2020-17405HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. AuthenEPSS 2.0%CVE-2026-64901HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-63514HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-65663HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-66805HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-65658HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-66808HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2022-0573HIGHJFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege EsEPSS 2.0%CVE-2021-39321HIGHSassy Social Share 3.3.23 PHP Object InjectionEPSS 2.0%CVE-2022-3357HIGHSmart Slider 3 < 3.5.1.11 - PHP Object InjectionEPSS 2.0%CVE-2021-22855CRITICALSoar Cloud System Co., Ltd. HR Portal - Arbitrary Code ExecutionEPSS 2.0%CVE-2020-12015—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserializatEPSS 2.0%CVE-2016-8648HIGHIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via EPSS 2.0%CVE-2024-47072HIGHXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamEPSS 2.0%