Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2026-23869HIGHA denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverEPSS 1.6%CVE-2024-29212CRITICALDue to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agEPSS 1.6%CVE-2023-21762HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 1.6%CVE-2023-51576CRITICALVoltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-28861CRITICALGadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolderEPSS 1.5%CVE-2026-25873CRITICALOmniGen2-RL Reward Server Unsafe Deserialization RCEEPSS 1.5%CVE-2026-40860CRITICALApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpEPSS 1.5%CVE-2024-22871HIGHAn issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__59EPSS 1.5%CVE-2026-33819CRITICALMicrosoft Bing Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-59124CRITICALMicrosoft High Performance Computing (HPC) Pack Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-54117CRITICALMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-26142CRITICALNuance PowerScribe Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-69836CRITICALMicrosoft Entra ID Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-55944CRITICALMicrosoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-54118CRITICALMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-26222CRITICALDocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCEEPSS 1.5%CVE-2026-28325HIGHSolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-49121CRITICALAI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle DeserializationEPSS 1.5%CVE-2023-50219HIGHInductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-21745HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 1.5%