Falhas do tipo CWE-502

3.016 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.6%KEVCVE-2020-12009—A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnEPSS 3.6%CVE-2021-21524CRITICALDell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unautEPSS 3.6%CVE-2026-3296CRITICALEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataEPSS 3.6%CVE-2020-10969HIGHFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEPSS 3.6%CVE-2020-15086CRITICALPotential Remote Code Execution in TYPO3 with mediace extensionEPSS 3.6%CVE-2021-40719CRITICALAdobe Connect Deserialization of Untrusted Data Remote Code ExecutionEPSS 3.5%CVE-2026-50509HIGHWireless Wide Area Network Service (WwanSvc) Elevation of Privilege VulnerabilityEPSS 3.5%CVE-2022-46366CRITICALApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputEPSS 3.5%CVE-2021-24217—Facebook for WordPress < 3.0.0 - PHP Object Injection with POP ChainEPSS 3.5%CVE-2018-11779—In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SEPSS 3.5%CVE-2021-41616CRITICALApache ddlutils 1.0 readobject vulnerabilityEPSS 3.5%CVE-2021-39150HIGHA Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingEPSS 3.4%CVE-2026-26114HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 3.4%CVE-2024-35249HIGHMicrosoft Dynamics 365 Business Central Remote Code Execution VulnerabilityEPSS 3.4%CVE-2016-9483—PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataEPSS 3.4%CVE-2023-38177MEDIUMMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 3.4%CVE-2022-42003HIGHIn FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitivEPSS 3.4%CVE-2022-42004HIGHIn FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromEPSS 3.4%CVE-2021-32824CRITICALRegular expression Denial of Service in MooToolsEPSS 3.4%