Fallos del tipo CWE-502

2665 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2023-31890CRITICALAn XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() pEPSS 1.0%CVE-2024-37288CRITICALA deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted paEPSS 1.0%CVE-2026-44795HIGHSpinnaker: Non-safe yaml deserialization allowing RCE when using specific typesEPSS 1.0%CVE-2023-51785HIGHApache InLong: Arbitrary File Read Vulnerability in Apache InLong ManagerEPSS 1.0%CVE-2023-5583HIGHWP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object InjectionEPSS 1.0%CVE-2019-6834HIGHA CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted syEPSS 1.0%CVE-2024-4019MEDIUMByzoro Smart S80 Management Platform importhtml.php deserializationEPSS 1.0%CVE-2026-15008HIGHUncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field TokenEPSS 1.0%CVE-2026-31072CRITICALThe JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCEPSS 1.0%CVE-2023-20102HIGHCisco Secure Network Analytics Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-62420HIGHDataEase vulnerable to remote code execution via H2 JDBC driver bypassEPSS 1.0%CVE-2024-11145CRITICALEasy Folder Listing Pro deserialization vulnerabilityEPSS 1.0%CVE-2023-20878HIGHVMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commEPSS 1.0%CVE-2026-54512HIGHjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationEPSS 1.0%CVE-2026-14890CRITICALCVE-2026-14890EPSS 1.0%CVE-2024-8514CRITICALPrisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object InjectionEPSS 1.0%CVE-2024-44102CRITICALA vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with reduEPSS 1.0%CVE-2024-40624CRITICALDeserialization of untrusted data in torrentpier/torrentpierEPSS 1.0%CVE-2026-34838CRITICALGroup-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`EPSS 1.0%CVE-2022-41203CRITICALIn some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privilEPSS 1.0%