Fallos del tipo CWE-502

2673 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-61750HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61762HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61757HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61760HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61779HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61763HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61773HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61755HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2026-61769HIGHNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of tEPSS 0.4%CVE-2025-10164MEDIUMlmsys sglang update_weights_from_tensor main deserializationEPSS 0.4%CVE-2024-31308MEDIUMWordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-58218HIGHWordPress Small Package Quotes – USPS Edition Plugin <= 1.3.9 - PHP Object Injection VulnerabilityEPSS 0.4%CVE-2026-51106CRITICALAn issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp componentEPSS 0.4%CVE-2026-97865MEDIUMOpen-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserializationEPSS 0.4%CVE-2024-39636HIGHWordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-49438HIGHWordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-73325HIGHFujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load DeserializationEPSS 0.4%CVE-2026-65493HIGHWordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-8708LOWAntabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserializationEPSS 0.4%CVE-2026-85017HIGHUnlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object InjectionEPSS 0.4%