Falhas do tipo CWE-502

2.649 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2023-47248—PyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileEPSS 14.5%CVE-2025-6507CRITICALDeserialization of Untrusted Data in h2oai/h2o-3EPSS 14.4%CVE-2021-21347MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 14.3%CVE-2021-39146HIGHXStream is vulnerable to an Arbitrary Code Execution attackEPSS 14.3%CVE-2026-43825HIGHApache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModelEPSS 13.9%CVE-2025-42999CRITICALInsecure Deserialization in SAP NetWeaver (Visual Composer development server)EPSS 13.9%KEVCVE-2021-21348MEDIUMXStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)EPSS 13.8%CVE-2019-9875HIGHDeserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary codeEPSS 13.8%KEVCVE-2022-36957HIGHSolarWinds Platform Deserialization of Untrusted DataEPSS 12.8%CVE-2020-35728HIGHFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wlEPSS 12.5%CVE-2026-45829CRITICALA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attackEPSS 12.4%CVE-2022-24082CRITICALIf an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filterEPSS 12.3%CVE-2022-25647HIGHDeserialization of Untrusted DataEPSS 12.2%CVE-2017-11153—Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers EPSS 12.2%CVE-2021-39152HIGHA Server-Side Forgery Request vulnerability in XStream via HashMap unmarshalingEPSS 11.4%CVE-2022-1118HIGHRockwell Automation ISaGRAF Deserialization of Untrusted DataEPSS 11.1%CVE-2024-28074CRITICALSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability EPSS 10.9%CVE-2022-34668CRITICALNVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileEPSS 10.9%CVE-2019-12814MEDIUMA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally oEPSS 10.9%CVE-2025-36038CRITICALIBM WebSphere Application Server code executionEPSS 10.8%