Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2022-2433HIGHWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR DeserializationEPSS 1.7%CVE-2020-36718CRITICALGDPR CCPA Compliance Support <= 2.3 - PHP Object InjectionEPSS 1.7%CVE-2026-66713CRITICALApache Axis2/Java: deserialization of untrusted DataEPSS 1.7%CVE-2025-32897CRITICALApache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerEPSS 1.7%CVE-2023-34434HIGHApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramEPSS 1.7%CVE-2021-20318—The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute aEPSS 1.7%CVE-2026-50517CRITICALMicrosoft M365 Copilot Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-77484HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-70321HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-50515CRITICALAzure Service Bus Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65665HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65815HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65772HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2022-1463HIGHBooking Calendar <= 9.1 - PHP Object Injection via ShortcodeEPSS 1.7%CVE-2023-1381HIGHWP Meta SEO < 4.5.5 - Author+ PHAR DeserializationEPSS 1.7%CVE-2021-39132HIGHYAML deserialization can run untrusted codeEPSS 1.7%CVE-2022-40314CRITICALA remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.EPSS 1.7%CVE-2021-37632HIGHDeserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacketEPSS 1.7%CVE-2022-41237CRITICALJenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a EPSS 1.7%