Fallos del tipo CWE-502

2699 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2022-32601HIGHIn telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with nEPSS 0.1%CVE-2026-19795MEDIUMQiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.EPSS 0.1%CVE-2025-54620MEDIUMDeserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect avaiEPSS 0.1%CVE-2025-7433HIGHA local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrarEPSS 0.1%CVE-2025-54640MEDIUMParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control EPSS 0.1%CVE-2025-54639MEDIUMParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control EPSS 0.1%CVE-2025-32312HIGHIn createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed toEPSS 0.1%CVE-2025-54638MEDIUMIssue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of this vulnerability may affect the availaEPSS 0.1%CVE-2018-9474HIGHIn writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This coulEPSS 0.1%CVE-2026-93624HIGHWordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilityEPSS —CVE-2026-100512CRITICALWordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityEPSS —CVE-2026-96344HIGHWordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerabilityEPSS —CVE-2026-103441HIGHUnauthenticated arbitrary file deletion through Wikibase serialized entity parsingEPSS —CVE-2026-94677HIGHWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerabilityEPSS —CVE-2026-103040CRITICALLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC ServiceEPSS —CVE-2026-97246MEDIUMWordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerabilityEPSS —CVE-2026-97248CRITICALWordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerabilityEPSS —CVE-2026-97291HIGHWordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerabilityEPSS —CVE-2026-93771HIGHWordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerabilityEPSS —CVE-2026-102455CRITICALDigiWin｜EasyFlow .NET - Insecure DeserializationEPSS —