Fallos del tipo CWE-502

3040 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2017-0903—RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem speEPSS 15.9%CVE-2026-25874CRITICALLeRobot Unsafe Deserialization Remote Code Execution via gRPCEPSS 15.5%CVE-2021-21350MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 15.2%CVE-2026-45829CRITICALA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attackEPSS 15.1%CVE-2022-36957HIGHSolarWinds Platform Deserialization of Untrusted DataEPSS 15.0%CVE-2022-36971CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authEPSS 15.0%CVE-2024-4044HIGHDeserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudioEPSS 14.7%CVE-2023-47248—PyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileEPSS 14.5%CVE-2021-21347MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 14.3%CVE-2021-39146HIGHXStream is vulnerable to an Arbitrary Code Execution attackEPSS 14.3%CVE-2026-43825HIGHApache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModelEPSS 13.9%CVE-2021-21348MEDIUMXStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)EPSS 13.8%CVE-2025-36038CRITICALIBM WebSphere Application Server code executionEPSS 13.3%CVE-2022-47507HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 12.9%CVE-2025-42999CRITICALInsecure Deserialization in SAP NetWeaver (Visual Composer development server)EPSS 12.9%KEVCVE-2020-35728HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wlEPSS 12.5%CVE-2022-25647HIGHDeserialization of Untrusted DataEPSS 12.2%CVE-2017-11153—Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers EPSS 12.2%CVE-2022-24082CRITICALIf an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filterEPSS 12.2%CVE-2022-34668CRITICALNVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileEPSS 11.6%