Fallos del tipo CWE-502

2669 resultados

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados recebidos (JSON, XML, binário) sem validar se o resultado é seguro. Um atacante pode injetar código malicioso ou estruturas que exploram o processo de desserialização para executar ações arbitrárias no servidor ou cliente.

Ejemplo

Um serviço Java desserializa um objeto enviado pelo usuário usando ObjectInputStream sem filtros. O atacante envia um payload serializado que, ao ser reconstituído, executa comandos do sistema. Cenário comum: aplicações legadas que confiam em dados de rede ou arquivos sem inspeção.

Cómo mitigar

Valide e filtre dados antes de desserializar — use listas de classes permitidas (whitelisting), implemente validação de schema, e prefira formatos simples (JSON com parse restritivo) em vez de binários com lógica automática. Para linguagens críticas como Java, use bibliotecas seguras ou desabilite gadgets perigosos.

CVE-2026-70426CRITICALIn Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, EPSS 0.5%CVE-2025-47771HIGHPowSyBl Core allows deserialization of untrusted SparseMatrix dataEPSS 0.5%CVE-2025-5680MEDIUMShenzhen Dashi Tongzhou Information Technology AgileBPM Groovy Script SysScriptController.java executeScript deserializationEPSS 0.5%CVE-2026-18163CRITICALIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.5%CVE-2025-61140CRITICALThe value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.EPSS 0.5%CVE-2025-13145HIGHWP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV ImportEPSS 0.5%CVE-2025-13707HIGHTencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-5679MEDIUMShenzhen Dashi Tongzhou Information Technology AgileBPM SysToolsController.java parseStrByFreeMarker deserializationEPSS 0.5%CVE-2025-13709HIGHTencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13710HIGHTencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13714HIGHTencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13711HIGHTencent TFace eval Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13706HIGHTencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13708HIGHTencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13716HIGHTencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-13712HIGHTencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-12305MEDIUMquequnlong shiyi-blog Job SysJobController.java deserializationEPSS 0.5%CVE-2024-57764CRITICALMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.EPSS 0.5%CVE-2024-57763CRITICALMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.EPSS 0.5%CVE-2024-57766CRITICALMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.EPSS 0.5%