Falhas do tipo CWE-502

3.019 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2024-53913CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53912CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53909CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-53911CRITICALAn issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrarEPSS 0.9%CVE-2024-2290HIGHAdvanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object InjectionEPSS 0.9%CVE-2026-102101HIGHKiteworks Core deserialization of untrusted dataEPSS 0.9%CVE-2022-44351CRITICALSkycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.EPSS 0.9%CVE-2022-2830HIGHDeserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)EPSS 0.9%CVE-2023-28462CRITICALA JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 andEPSS 0.9%CVE-2024-0302MEDIUMfhs-opensource iparking vueLogin deserializationEPSS 0.9%CVE-2025-22777CRITICALWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilityEPSS 0.9%CVE-2024-49375CRITICALRemote Code Execution via Remote Model Loading in RasaEPSS 0.9%CVE-2024-31879HIGHIBM i denial of serviceEPSS 0.9%CVE-2026-33701CRITICALOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionEPSS 0.9%CVE-2026-66256HIGHApache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)EPSS 0.9%CVE-2023-21568HIGHMicrosoft SQL Server Integration Service (VS extension) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-24302CRITICALAn issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attaEPSS 0.9%CVE-2024-25117MEDIUMphp-svg-lib lacks path validation on font through SVG inline styles EPSS 0.9%CVE-2024-9070CRITICALDeserialization Vulnerability in BentoML's Runner Server in bentoml/bentomlEPSS 0.9%CVE-2025-25691MEDIUMA PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a cEPSS 0.9%