Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2022-24282HIGHA vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All EPSS 1.4%CVE-2023-26779CRITICALCleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).EPSS 1.4%CVE-2026-25550CRITICALSeagull Software BarTender Unauthenticated RCE via .NET Remoting ServiceEPSS 1.4%CVE-2023-40571CRITICALweblogic-framework Deserialization of Untrusted Data vulnerabilityEPSS 1.4%CVE-2023-35184HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-36984HIGHRemote Code Execution through Serialized Session Payload in Splunk Enterprise on WindowsEPSS 1.4%CVE-2022-2903HIGHNinjaForms < 3.6.13 - Admin+ PHP Objection InjectionEPSS 1.4%CVE-2026-26221CRITICALHyland OnBase Timer Service Unauthenticated .NET Remoting RCEEPSS 1.4%CVE-2025-0912CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object InjectionEPSS 1.4%CVE-2026-56121CRITICALFeast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC DeserializationEPSS 1.4%CVE-2023-28500CRITICALA Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gaiEPSS 1.4%CVE-2023-32336HIGHIBM InfoSphere Information Server code executionEPSS 1.4%CVE-2023-1714HIGHBitrix24 Remote Command Execution (RCE) via Unsafe Variable ExtractionEPSS 1.4%CVE-2026-67260HIGHApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializationEPSS 1.4%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.4%CVE-2021-21956HIGHA php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed fileEPSS 1.4%CVE-2024-9634CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.4%CVE-2022-44371CRITICALhope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).EPSS 1.4%CVE-2023-36736MEDIUMMicrosoft Identity Linux Broker Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-9053CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.4%