Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-32897CRITICALApache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerEPSS 2.0%CVE-2026-35439HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2020-12015—A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserializatEPSS 2.0%CVE-2026-12583HIGHNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldEPSS 2.0%CVE-2022-46478CRITICALThe RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrEPSS 2.0%CVE-2024-47072HIGHXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamEPSS 2.0%CVE-2024-6327CRITICALProgress Telerik Report Server DeserializationEPSS 2.0%CVE-2020-11067HIGHDeserialization of Untrusted Data in TYPO3 CMSEPSS 2.0%CVE-2021-29485CRITICALRemote Code Execution Vulnerability in Session StorageEPSS 2.0%CVE-2016-8648HIGHIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via EPSS 2.0%CVE-2026-62912MEDIUMMicrosoft Exchange Server Denial of Service VulnerabilityEPSS 2.0%CVE-2026-33110HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-24280—Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object InjectionEPSS 2.0%CVE-2022-21624LOWVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that EPSS 2.0%CVE-2023-38647CRITICALApache Helix: Deserialization vulnerability in Helix workflow and RESTEPSS 2.0%CVE-2026-12650CRITICALA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2026-12651HIGHA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2026-12648HIGHA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeEPSS 1.9%CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%CVE-2022-44645HIGHApache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityEPSS 1.9%