Falhas do tipo CWE-502

2.653 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2020-11112HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.coEPSS 3.7%CVE-2020-6770CRITICALDeserialization of Untrusted Data in Bosch BVMS Mobile Video ServiceEPSS 3.6%CVE-2020-10968HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.EPSS 3.6%CVE-2020-12009—A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnEPSS 3.6%CVE-2020-11111HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.acEPSS 3.6%CVE-2022-28684HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to EPSS 3.6%CVE-2020-10969HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEPSS 3.6%CVE-2025-47732HIGHMicrosoft Dataverse Remote Code Execution VulnerabilityEPSS 3.5%CVE-2021-40719CRITICALAdobe Connect Deserialization of Untrusted Data Remote Code ExecutionEPSS 3.5%CVE-2026-50509HIGHWireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityEPSS 3.5%CVE-2021-24217—Facebook for WordPress < 3.0.0 - PHP Object Injection with POP ChainEPSS 3.5%CVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.5%KEVCVE-2018-11779—In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SEPSS 3.5%CVE-2026-3296CRITICALEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataEPSS 3.5%CVE-2021-41616CRITICALApache ddlutils 1.0 readobject vulnerabilityEPSS 3.5%CVE-2021-39150HIGHA Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingEPSS 3.4%CVE-2024-35249HIGHMicrosoft Dynamics 365 Business Central Remote Code Execution VulnerabilityEPSS 3.4%CVE-2016-9483—PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataEPSS 3.4%CVE-2023-38177MEDIUMMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 3.4%CVE-2022-46366CRITICALApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputEPSS 3.4%