Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2023-28500CRITICALA Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gaiEPSS 1.4%CVE-2023-32336HIGHIBM InfoSphere Information Server code executionEPSS 1.4%CVE-2021-21956HIGHA php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed fileEPSS 1.4%CVE-2021-21865HIGHA unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYSEPSS 1.4%CVE-2024-9634CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.4%CVE-2025-30384HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2025-29807HIGHMicrosoft Dataverse Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-41779HIGH Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the devEPSS 1.4%CVE-2023-36736MEDIUMMicrosoft Identity Linux Broker Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-9053CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.4%CVE-2022-48282MEDIUMDeserializing compromised object with MongoDB .NET/C# Driver may cause remote code executionEPSS 1.4%CVE-2023-35317HIGHWindows Server Update Service (WSUS) Elevation of Privilege VulnerabilityEPSS 1.4%CVE-2023-46227HIGHApache inlong has an Arbitrary File Read VulnerabilityEPSS 1.4%CVE-2026-2037HIGHGFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-2036HIGHGFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.4%CVE-2020-7532—A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could alloEPSS 1.4%CVE-2023-48886CRITICALA deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.EPSS 1.4%CVE-2023-26512CRITICALApache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataEPSS 1.4%CVE-2020-6219CRITICALSAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2EPSS 1.4%CVE-2020-7528—A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbEPSS 1.4%