Falhas do tipo CWE-502

2.648 resultados

Desserialização de dados não confiáveis

A aplicação converte dados recebidos de fontes externas (requisições, arquivos, rede) de volta para objetos em memória sem validar se o conteúdo é legítimo. Um atacante pode enviar dados malformados ou maliciosos que, ao serem desserializados, executam código arbitrário ou alteram o comportamento da aplicação.

Exemplo

Um servidor Java que desserializa objetos vindo de um cliente usando ObjectInputStream sem verificar a origem. Um atacante envia um objeto serializado contendo uma gadget chain que executa comandos do sistema operacional quando desserializado.

Como mitigar

Valide rigorosamente o tipo e estrutura dos dados antes de desserializar; use bibliotecas modernas que restringem quais classes podem ser desserializadas (com allowlists); considere alternativas como JSON com parsers estritamente tipados ao invés de serialização nativa de linguagem.

CVE-2026-20963CRITICALMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 32.6%KEVCVE-2026-20251HIGHRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure GatewayEPSS 32.2%CVE-2021-27852CRITICALDeserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute aEPSS 31.9%KEVCVE-2023-3001HIGH A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious pEPSS 31.9%CVE-2023-4528HIGHJSCAPE MFT Server Unsafe Deserialization on Management PortEPSS 31.9%CVE-2025-0994HIGHTrimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vEPSS 31.3%KEVCVE-2025-30285HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.9%CVE-2024-21318HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 30.8%CVE-2024-41874CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 30.3%CVE-2024-8353CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object InjectionEPSS 28.7%CVE-2023-31222CRITICALMedtronic Paceart MSMQ Deserialization of Untrusted DataEPSS 28.5%CVE-2018-15957CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 28.2%CVE-2026-45247CRITICALMirasvit Cache Warmer for Magento < 1.11.12 PHP Object InjectionEPSS 27.5%KEVCVE-2023-35180HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability EPSS 27.4%CVE-2018-15965CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2018-15958CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2018-15959CRITICALAdobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untruEPSS 25.9%CVE-2025-53772HIGHWeb Deploy Remote Code Execution VulnerabilityEPSS 25.8%CVE-2022-47504HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 25.1%CVE-2023-28310HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 25.0%