Falhas do tipo CWE-502

2.648 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2024-38094HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 50.9%KEVCVE-2023-44351CRITICALAdobe ColdFusion RCE Security VulnerabilityEPSS 50.2%CVE-2021-21342MEDIUMA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostEPSS 50.0%CVE-2017-17485CRITICALFasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix EPSS 49.7%CVE-2023-36756HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 49.2%CVE-2022-33318CRITICALDeserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiEPSS 48.1%CVE-2020-10914CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. AuthenticationEPSS 47.9%CVE-2024-23759CRITICALDeserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the ParcelshopfEPSS 47.5%CVE-2021-21349MEDIUMA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostEPSS 46.8%CVE-2021-21343MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsEPSS 46.7%CVE-2020-8165—A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal userEPSS 45.7%CVE-2024-38024HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 45.2%CVE-2022-39379LOWFluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)EPSS 45.0%CVE-2024-55556CRITICALA vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on thEPSS 44.1%CVE-2025-30065CRITICALApache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadataEPSS 43.6%CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 43.5%CVE-2022-35870HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202EPSS 43.3%CVE-2025-68664CRITICALLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsEPSS 42.9%CVE-2024-3054HIGHWPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR DeserializationEPSS 41.5%CVE-2017-7504—HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss AppliEPSS 41.0%