Fallos del tipo CWE-502

3041 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2021-22855CRITICALSoar Cloud System Co., Ltd. HR Portal - Arbitrary Code ExecutionEPSS 2.0%CVE-2025-32897CRITICALApache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerEPSS 2.0%CVE-2026-35439HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2020-12015—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserializatEPSS 2.0%CVE-2026-12583HIGHNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldEPSS 2.0%CVE-2022-46478CRITICALThe RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrEPSS 2.0%CVE-2024-47072HIGHXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamEPSS 2.0%CVE-2024-6327CRITICALProgress Telerik Report Server DeserializationEPSS 2.0%CVE-2020-11067HIGHDeserialization of Untrusted Data in TYPO3 CMSEPSS 2.0%CVE-2021-29485CRITICALRemote Code Execution Vulnerability in Session StorageEPSS 2.0%CVE-2016-8648HIGHIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via EPSS 2.0%CVE-2026-62912MEDIUMMicrosoft Exchange Server Denial of Service VulnerabilityEPSS 2.0%CVE-2026-33110HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-24280—Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object InjectionEPSS 2.0%CVE-2022-21624LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that EPSS 2.0%CVE-2023-38647CRITICALApache Helix: Deserialization vulnerability in Helix workflow and RESTEPSS 2.0%CVE-2026-12650CRITICALA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2026-12648HIGHA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2026-12651HIGHA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%