Fallos del tipo CWE-502

2653 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2020-11112HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.coEPSS 3.7%CVE-2020-6770CRITICALDeserialization of Untrusted Data in Bosch BVMS Mobile Video ServiceEPSS 3.6%CVE-2020-10968HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.EPSS 3.6%CVE-2020-12009—A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnEPSS 3.6%CVE-2020-11111HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.acEPSS 3.6%CVE-2022-28684HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to EPSS 3.6%CVE-2020-10969HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEPSS 3.6%CVE-2025-47732HIGHMicrosoft Dataverse Remote Code Execution VulnerabilityEPSS 3.5%CVE-2021-40719CRITICALAdobe Connect Deserialization of Untrusted Data Remote Code ExecutionEPSS 3.5%CVE-2026-50509HIGHWireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityEPSS 3.5%CVE-2021-24217—Facebook for WordPress < 3.0.0 - PHP Object Injection with POP ChainEPSS 3.5%CVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.5%KEVCVE-2018-11779—In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SEPSS 3.5%CVE-2026-3296CRITICALEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataEPSS 3.5%CVE-2021-41616CRITICALApache ddlutils 1.0 readobject vulnerabilityEPSS 3.5%CVE-2021-39150HIGHA Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingEPSS 3.4%CVE-2024-35249HIGHMicrosoft Dynamics 365 Business Central Remote Code Execution VulnerabilityEPSS 3.4%CVE-2016-9483—PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataEPSS 3.4%CVE-2023-38177MEDIUMMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 3.4%CVE-2022-46366CRITICALApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputEPSS 3.4%