Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2022-48282MEDIUMDeserializing compromised object with MongoDB .NET/C# Driver may cause remote code executionEPSS 1.4%CVE-2023-45672HIGHFrigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`EPSS 1.4%CVE-2020-7532—A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could alloEPSS 1.4%CVE-2025-29807HIGHMicrosoft Dataverse Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-48886CRITICALA deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.EPSS 1.4%CVE-2020-7528—A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbEPSS 1.4%CVE-2025-30378HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-56816HIGHDatart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrEPSS 1.4%CVE-2023-26512CRITICALApache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataEPSS 1.3%CVE-2026-3060CRITICALCVE-2026-3060EPSS 1.3%CVE-2026-3059CRITICALCVE-2026-3059EPSS 1.3%CVE-2024-39705CRITICALNLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download funEPSS 1.3%CVE-2023-33963CRITICALDataEase data source has deserialization vulnerabilityEPSS 1.3%CVE-2020-12525HIGHWAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER componentEPSS 1.3%CVE-2019-17635—Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is reEPSS 1.3%CVE-2017-20189CRITICALIn Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relEPSS 1.3%CVE-2024-12044CRITICALRemote Code Execution by Pickle Deserialization in open-mmlab/mmdetectionEPSS 1.3%CVE-2024-42362HIGHGHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/importEPSS 1.3%CVE-2025-30384HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-8862MEDIUMh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationEPSS 1.3%