Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2024-6327CRITICALProgress Telerik Report Server DeserializationEPSS 2.0%CVE-2020-11067HIGHDeserialization of Untrusted Data in TYPO3 CMSEPSS 2.0%CVE-2021-29485CRITICALRemote Code Execution Vulnerability in Session StorageEPSS 2.0%CVE-2026-62912MEDIUMMicrosoft Exchange Server Denial of Service VulnerabilityEPSS 2.0%CVE-2022-3360HIGHLearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST APIEPSS 2.0%CVE-2022-2436HIGHDownload Manager <= 3.2.49 - Authenticated (Contributor+) PHAR DeserializationEPSS 2.0%CVE-2021-24280—Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object InjectionEPSS 2.0%CVE-2023-38647CRITICALApache Helix: Deserialization vulnerability in Helix workflow and RESTEPSS 2.0%CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%CVE-2016-8653MEDIUMIt was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could EPSS 1.9%CVE-2022-44645HIGHApache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityEPSS 1.9%CVE-2026-42471HIGHUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on EPSS 1.9%CVE-2023-26464HIGHApache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderEPSS 1.9%CVE-2025-8875CRITICALInsecure Deserialization VulnerabilityEPSS 1.9%KEVCVE-2021-37181—A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions),EPSS 1.9%CVE-2021-35196HIGHManuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because thEPSS 1.9%CVE-2022-39944HIGHThe Apache Linkis JDBC EngineConn module has a RCE VulnerabilityEPSS 1.9%CVE-2019-10135HIGHA flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function EPSS 1.9%CVE-2026-58127CRITICALPACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP ServiceEPSS 1.9%CVE-2024-34515HIGHimage-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().EPSS 1.9%