Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 70
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 7966 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 788

ID Title
CVE-2026-34615 Unsafe Deserialization in deserialization (CVE-2026-34615)
CVE-2026-27303 Unsafe Deserialization in deserialization (CVE-2026-27303)
CVE-2026-1462 Unsafe Deserialization in keras (CVE-2026-1462)
CVE-2026-25204 Unsafe Deserialization in dos (CVE-2026-25204)
CVE-2023-21529 KEV [KEV] Unsafe Deserialization in Microsoft exchange-server (CVE-2023-21529)
CVE-2026-3199 Unsafe Deserialization in CVE-2026-3199 (CVE-2026-3199)
CVE-2026-23869 Vulnerability in react (CVE-2026-23869)
CVE-2026-39890 Unsafe Deserialization in praisonai (CVE-2026-39890)
CVE-2026-32590 Unsafe Deserialization in redhat (CVE-2026-32590)
CVE-2026-3296 Unsafe Deserialization in wordpress (CVE-2026-3296)
CVE-2026-3357 Unsafe Deserialization in deserialization (CVE-2026-3357)
CVE-2026-33439 Unsafe Deserialization in deserialization (CVE-2026-33439)
CVE-2026-24156 Unsafe Deserialization in deserialization (CVE-2026-24156)
CVE-2026-5536 Vulnerability in deserialization (CVE-2026-5536)
CVE-2026-5473 Vulnerability in deserialization (CVE-2026-5473)
CVE-2026-35537 Unsafe Deserialization in deserialization (CVE-2026-35537)
CVE-2026-35171 Code Injection in kedro (CVE-2026-35171)
CVE-2026-34838 Unsafe Deserialization in deserialization (CVE-2026-34838)
CVE-2026-34877 Vulnerability in arm (CVE-2026-34877)
CVE-2026-24165 Unsafe Deserialization in dos (CVE-2026-24165)
CVE-2026-24164 Unsafe Deserialization in dos (CVE-2026-24164)
CVE-2026-34202 Code Injection in deserialization (CVE-2026-34202)
CVE-2026-4266 Unsafe Deserialization in deserialization (CVE-2026-4266)
CVE-2026-33728 Unsafe Deserialization in com.datadoghq:dd-java-agent (CVE-2026-33728)
CVE-2026-33701 Unsafe Deserialization in io.opentelemetry.javaagent:opentelemetry-javaagent (CVE-2026-33701)
CVE-2026-0677 Unsafe Deserialization in deserialization (CVE-2026-0677)
CVE-2025-71260 Unsafe Deserialization in csharp (CVE-2025-71260)
CVE-2026-20131 KEV [KEV] Unsafe Deserialization in Cisco secure-firewall-management-center-fmc (CVE-2026-20131)
CVE-2026-25873 Unsafe Deserialization in deserialization (CVE-2026-25873)
CVE-2026-20963 KEV [KEV] Unsafe Deserialization in Microsoft sharepoint (CVE-2026-20963)

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →