Fallos del tipo CWE-502

2653 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2023-29216CRITICALApache Linkis DatasourceManager module has a deserialization command executionEPSS 2.1%CVE-2025-24447CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 2.1%CVE-2024-11039HIGHDeserialization of Untrusted Data in binary-husky/gpt_academicEPSS 2.1%CVE-2020-26207HIGHUnsafe deserialization in DatabaseSchemaViewerEPSS 2.1%CVE-2026-12745CRITICALA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execuEPSS 2.1%CVE-2025-30284HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 2.1%CVE-2023-34040MEDIUMJava Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredEPSS 2.1%CVE-2025-54539CRITICALApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataEPSS 2.1%CVE-2024-3568LOWArbitrary Code Execution via Deserialization in huggingface/transformersEPSS 2.1%CVE-2022-31604CRITICALNVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via piEPSS 2.1%CVE-2022-31605CRITICALNVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.EPSS 2.1%CVE-2021-24384—JoomSport < 5.1.8 - Unauthenticated PHP Object InjectionEPSS 2.1%CVE-2020-10740MEDIUMA vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise ApEPSS 2.1%CVE-2018-7529—A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modifEPSS 2.1%CVE-2025-55232CRITICALMicrosoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-62204HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-32434CRITICALPyTorch: `torch.load` with `weights_only=True` leads to remote code executionEPSS 2.1%CVE-2025-29953CRITICALApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassEPSS 2.1%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.1%CVE-2020-17405HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. AuthenEPSS 2.0%