Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2021-33420CRITICALA deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializablEPSS 1.7%CVE-2020-5411—Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"EPSS 1.7%CVE-2021-36336CRITICALWyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execuEPSS 1.7%CVE-2023-34434HIGHApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramEPSS 1.7%CVE-2026-40357HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65772HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-70321HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-50515CRITICALAzure Service Bus Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65815HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-50517CRITICALMicrosoft M365 Copilot Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-65665HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2026-77484HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2023-1381HIGHWP Meta SEO < 4.5.5 - Author+ PHAR DeserializationEPSS 1.7%CVE-2021-39132HIGHYAML deserialization can run untrusted codeEPSS 1.7%CVE-2022-41237CRITICALJenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a EPSS 1.7%CVE-2021-37632HIGHDeserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacketEPSS 1.7%CVE-2021-1413MEDIUMCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution VulnerabilitiesEPSS 1.7%CVE-2021-1415MEDIUMCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution VulnerabilitiesEPSS 1.7%CVE-2024-49063HIGHMicrosoft/Muzic Remote Code Execution VulnerabilityEPSS 1.7%