Fallos del tipo CWE-502

2661 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2022-33318CRITICALDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiEPSS 48.1%CVE-2020-10914CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. AuthenticationEPSS 47.9%CVE-2024-23759CRITICALDeserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the ParcelshopfEPSS 47.5%CVE-2021-21349MEDIUMA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostEPSS 46.8%CVE-2021-21343MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsEPSS 46.7%CVE-2026-12569CRITICALRemote Code Execution (RCE) vulnerability in Windchill PDMlinkEPSS 46.0%KEVCVE-2020-8165—A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal userEPSS 45.7%CVE-2024-38024HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 45.2%CVE-2022-39379LOWFluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)EPSS 45.0%CVE-2024-55556CRITICALA vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on thEPSS 44.1%CVE-2025-30065CRITICALApache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadataEPSS 43.6%CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 43.5%CVE-2022-35870HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202EPSS 43.3%CVE-2025-68664CRITICALLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsEPSS 42.9%CVE-2026-20131CRITICALCisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityEPSS 42.7%KEVCVE-2024-3054HIGHWPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR DeserializationEPSS 41.5%CVE-2025-27520CRITICALBentoML Allows Remote Code Execution (RCE) via Insecure DeserializationEPSS 40.6%CVE-2024-1800CRITICALProgress Telerik Report Server DeserializationEPSS 40.4%CVE-2017-7504—HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss AppliEPSS 39.7%CVE-2024-32030HIGHRemote code execution via JNDI resolution in JMX metrics collection in Kafka UIEPSS 39.4%