Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 1.0%CVE-2026-83497HIGHUnrestricted Java Deserialization in OpenSearch SQL Plugin Cursor PaginationEPSS 1.0%CVE-2026-26220CRITICALLightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCEEPSS 1.0%CVE-2026-43642CRITICALSoftaculous Virtualizor PHP Object Injection via Billing Module HandlerEPSS 1.0%CVE-2023-48952HIGHAn issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)EPSS 1.0%CVE-2026-58281HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-34414CRITICALEntrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCEEPSS 1.0%CVE-2025-6544CRITICALDeserialization Vulnerability in h2oai/h2o-3EPSS 1.0%CVE-2023-47204CRITICALUnsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.EPSS 1.0%CVE-2026-5127HIGHUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object InjectionEPSS 1.0%CVE-2023-34347CRITICAL​Delta Electronics InfraSuite Device Master Deserialization of Untrusted DataEPSS 1.0%CVE-2026-105013HIGHMicrosoft Office SharePoint Remote Code Execution VulnerabilityEPSS 1.0%CVE-2022-3525CRITICALDeserialization of Untrusted Data in librenms/librenmsEPSS 1.0%CVE-2023-3259CRITICALThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP addEPSS 1.0%CVE-2026-21226HIGHAzure Core shared client library for Python Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-12562CRITICALs2Member Pro <= 241216 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2021-22777—A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.EPSS 0.9%CVE-2024-53915CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53914CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53911CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrarEPSS 0.9%