Fallos del tipo CWE-502

2665 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2022-24282HIGHA vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All EPSS 1.4%CVE-2023-26779CRITICALCleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).EPSS 1.4%CVE-2026-25550CRITICALSeagull Software BarTender Unauthenticated RCE via .NET Remoting ServiceEPSS 1.4%CVE-2023-40571CRITICALweblogic-framework Deserialization of Untrusted Data vulnerabilityEPSS 1.4%CVE-2023-35184HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-36984HIGHRemote Code Execution through Serialized Session Payload in Splunk Enterprise on WindowsEPSS 1.4%CVE-2022-2903HIGHNinjaForms < 3.6.13 - Admin+ PHP Objection InjectionEPSS 1.4%CVE-2026-26221CRITICALHyland OnBase Timer Service Unauthenticated .NET Remoting RCEEPSS 1.4%CVE-2025-0912CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object InjectionEPSS 1.4%CVE-2026-56121CRITICALFeast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC DeserializationEPSS 1.4%CVE-2023-28500CRITICALA Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gaiEPSS 1.4%CVE-2023-32336HIGHIBM InfoSphere Information Server code executionEPSS 1.4%CVE-2023-1714HIGHBitrix24 Remote Command Execution (RCE) via Unsafe Variable ExtractionEPSS 1.4%CVE-2026-67260HIGHApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializationEPSS 1.4%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.4%CVE-2021-21956HIGHA php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed fileEPSS 1.4%CVE-2024-9634CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.4%CVE-2022-44371CRITICALhope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).EPSS 1.4%CVE-2023-36736MEDIUMMicrosoft Identity Linux Broker Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-9053CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.4%