Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2024-11039HIGHDeserialization of Untrusted Data in binary-husky/gpt_academicEPSS 2.1%CVE-2022-40314CRITICALA remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.EPSS 2.1%CVE-2020-26207HIGHUnsafe deserialization in DatabaseSchemaViewerEPSS 2.1%CVE-2025-29953CRITICALApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassEPSS 2.1%CVE-2023-34040MEDIUMJava Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredEPSS 2.1%CVE-2024-3568LOWArbitrary Code Execution via Deserialization in huggingface/transformersEPSS 2.1%CVE-2026-100214HIGHMicrosoft Dynamics 365 Business Central Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-54539CRITICALApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataEPSS 2.1%CVE-2021-24384—JoomSport < 5.1.8 - Unauthenticated PHP Object InjectionEPSS 2.1%CVE-2020-10740MEDIUMA vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise ApEPSS 2.1%CVE-2018-7529—A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modifEPSS 2.1%CVE-2020-17405HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. AuthenEPSS 2.0%CVE-2026-65663HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-66808HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-66805HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-63514HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-65658HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-64901HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-39321HIGHSassy Social Share 3.3.23 PHP Object InjectionEPSS 2.0%CVE-2021-22855CRITICALSoar Cloud System Co., Ltd. HR Portal - Arbitrary Code ExecutionEPSS 2.0%