Falhas do tipo CWE-502

3.017 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2020-9548CRITICALFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteroEPSS 18.9%CVE-2025-56005CRITICALAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parametEPSS 18.8%CVE-2025-20124CRITICALCisco Identity Services Engine Java Deserialization VulnerabilityEPSS 18.6%CVE-2022-38142CRITICAL Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway EPSS 18.6%CVE-2020-9547CRITICALFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqEPSS 18.4%CVE-2024-8069MEDIUMLimited remote code execution with privilege of a NetworkService Account accessEPSS 18.2%KEVCVE-2022-36964HIGHSolarWinds Platform Deserialization of Untrusted DataEPSS 17.8%CVE-2023-1669HIGHSEOPress < 6.5.0.3 - Admin+ PHP Object InjectionEPSS 17.7%CVE-2024-10456CRITICALDelta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 17.6%CVE-2021-43297—Dubbo Hessian cause RCE when parse errorEPSS 17.4%CVE-2021-24040—Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicioEPSS 17.4%CVE-2025-6507CRITICALDeserialization of Untrusted Data in h2oai/h2o-3EPSS 17.3%CVE-2022-28685HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802EPSS 17.2%CVE-2020-36179HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apacEPSS 17.1%CVE-2023-26359CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 17.0%KEVCVE-2022-1660CRITICALKeysight N6854A Geolocation server and N6841A RF Sensor softwareEPSS 16.8%CVE-2023-47207CRITICALDelta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 16.6%CVE-2021-39141HIGHXStream is vulnerable to an Arbitrary Code Execution attackEPSS 16.1%CVE-2023-1347HIGHCustomizer Export/Import < 0.9.6 - Admin+ PHP Object InjectionEPSS 16.0%CVE-2026-58644CRITICALMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 15.9%KEV