Fallos del tipo CWE-502

2665 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-25874CRITICALLeRobot Unsafe Deserialization Remote Code Execution via gRPCEPSS 1.0%CVE-2026-49286HIGHPhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)EPSS 0.9%CVE-2024-12562CRITICALs2Member Pro <= 241216 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2026-42359HIGHApache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validatorEPSS 0.9%CVE-2025-34491HIGHGFI MailEssentials < 21.8 MultiNode Insecure DeserializationEPSS 0.9%CVE-2024-31879HIGHIBM i denial of serviceEPSS 0.9%CVE-2021-22777—A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.EPSS 0.9%CVE-2024-53913CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53915CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53910CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53911CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53914CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53912CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53909CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-2290HIGHAdvanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object InjectionEPSS 0.9%CVE-2024-0302MEDIUMfhs-opensource iparking vueLogin deserializationEPSS 0.9%CVE-2023-28462CRITICALA JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 andEPSS 0.9%CVE-2025-22777CRITICALWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilityEPSS 0.9%CVE-2026-66256HIGHApache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)EPSS 0.9%CVE-2025-43851HIGHGHSL-2025-021_Retrieval-based-Voice-Conversion-WebUIEPSS 0.9%