Weaknesses of type CWE-502

2,665 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2023-36825CRITICALOrchid Deserialization of Untrusted Data vulnerability leads to Remote Code ExecutionEPSS 1.1%CVE-2024-10190CRITICALUnauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovodEPSS 1.1%CVE-2026-25917HIGHApache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)EPSS 1.1%CVE-2026-50632HIGHApache CXF: JNDI Injection Vulnerability in JMSConfigFactoryEPSS 1.1%CVE-2026-63767CRITICALktransformers Unauthenticated Pickle Deserialization RCE via ZMQEPSS 1.1%CVE-2023-7334CRITICALChangjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCEEPSS 1.1%CVE-2023-3308MEDIUMwhaleal IceFrog Aviator Template Engine deserializationEPSS 1.1%CVE-2023-30898CRITICALA vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versionsEPSS 1.1%CVE-2023-30899CRITICALA vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versionsEPSS 1.1%CVE-2025-7697CRITICALIntegration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val FunctionEPSS 1.1%CVE-2026-33701CRITICALOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionEPSS 1.1%CVE-2024-10936HIGHString Locator <= 2.6.6 - Unauthenticated PHP Object InjectionEPSS 1.1%CVE-2024-12312HIGHPrint Science Designer <= 1.3.152 - Unauthenticated PHP Object InjectionEPSS 1.1%CVE-2023-28667CRITICALThe Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels paraEPSS 1.1%CVE-2021-33175—EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the hanEPSS 1.1%CVE-2021-33176—VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due toEPSS 1.1%CVE-2026-16099HIGHPodlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' ParameterEPSS 1.1%CVE-2016-9585—Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passeEPSS 1.1%CVE-2026-71513HIGHNLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name BypassEPSS 1.1%CVE-2024-11409HIGHGrid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object InjectionEPSS 1.1%