Fallos del tipo CWE-502

3028 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2022-21445CRITICALVulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported vEPSS 62.5%KEVCVE-2021-42130—A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail SerEPSS 62.2%CVE-2018-4939CRITICALAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of UntrusteEPSS 61.8%KEVCVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 60.7%KEVCVE-2023-21529HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 59.3%KEVCVE-2023-36744HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 57.1%CVE-2019-5434—An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" paraEPSS 57.0%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 54.9%CVE-2022-23307HIGHA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.EPSS 54.4%CVE-2021-24307—All in One SEO Pack < 4.1.0.2 - Admin RCE via unserializeEPSS 53.3%CVE-2024-38023HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 52.9%CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2024-29847CRITICALDeserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentiEPSS 52.1%CVE-2023-36777MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 52.0%CVE-2025-49533CRITICALAdobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)EPSS 51.7%CVE-2024-24725HIGHGibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modEPSS 51.6%CVE-2024-38018HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 51.2%CVE-2026-53435HIGHIn Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in JEPSS 51.2%CVE-2024-32030HIGHRemote code execution via JNDI resolution in JMX metrics collection in Kafka UIEPSS 51.1%