Falhas do tipo CWE-502

2.648 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2023-36744HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 62.3%CVE-2021-42130—A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail SerEPSS 62.2%CVE-2023-21529HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 62.1%KEVCVE-2018-4939CRITICALAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of UntrusteEPSS 62.1%KEVCVE-2026-58644CRITICALMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 60.9%KEVCVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 60.4%CVE-2019-5434—An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" paraEPSS 57.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.2%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2022-23307HIGHA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.EPSS 54.4%CVE-2021-24307—All in One SEO Pack < 4.1.0.2 - Admin RCE via unserializeEPSS 53.3%CVE-2026-53435HIGHIn Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in JEPSS 53.1%CVE-2025-49533CRITICALAdobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)EPSS 52.9%CVE-2024-29847CRITICALDeserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentiEPSS 52.9%CVE-2024-38023HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 52.9%CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2023-36777MEDIUMMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 52.0%CVE-2024-24725HIGHGibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modEPSS 51.3%CVE-2024-38018HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 51.2%CVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 51.1%KEV