Fallos del tipo CWE-502

2648 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-20963CRITICALMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 32.6%KEVCVE-2026-20251HIGHRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure GatewayEPSS 32.2%CVE-2021-27852CRITICALDeserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute aEPSS 31.9%KEVCVE-2023-3001HIGH A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious pEPSS 31.9%CVE-2023-4528HIGHJSCAPE MFT Server Unsafe Deserialization on Management PortEPSS 31.9%CVE-2025-0994HIGHTrimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vEPSS 31.3%KEVCVE-2025-30285HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.9%CVE-2024-21318HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 30.8%CVE-2024-41874CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.3%CVE-2024-8353CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object InjectionEPSS 28.7%CVE-2023-31222CRITICALMedtronic Paceart MSMQ Deserialization of Untrusted DataEPSS 28.5%CVE-2018-15957CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 28.2%CVE-2026-45247CRITICALMirasvit Cache Warmer for Magento < 1.11.12 PHP Object InjectionEPSS 27.5%KEVCVE-2023-35180HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability EPSS 27.4%CVE-2018-15965CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2018-15958CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2018-15959CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2025-53772HIGHWeb Deploy Remote Code Execution VulnerabilityEPSS 25.8%CVE-2022-47504HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 25.1%CVE-2023-28310HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 25.0%