Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-69659 Unsafe Deserialization in Ash Hq (CVE-2026-69659)
CVE-2026-19363 Information Disclosure in lmammino oidc-authorizer (CVE-2026-19363)
CVE-2026-16267 Unsafe Deserialization in Newsletters (WordPress plugin) (CVE-2026-16267)
CVE-2026-68772 Unsafe Deserialization in ZenML (CVE-2026-68772)
CVE-2026-71560 Out-of-Bounds Read in Apache (CVE-2026-71560)
CVE-2026-71558 Unsafe Deserialization in Apache (CVE-2026-71558)
CVE-2026-71559 Unsafe Deserialization in Apache (CVE-2026-71559)
CVE-2026-16258 Unsafe Deserialization in Ajax Search Lite (WordPress plugin) (CVE-2026-16258)
CVE-2026-50515 Unsafe Deserialization in Azure Service Bus (CVE-2026-50515)
CVE-2026-65578 Unsafe Deserialization in Agora (CVE-2026-65578)
CVE-2026-65577 Unsafe Deserialization in Advice (CVE-2026-65577)
CVE-2026-65576 Unsafe Deserialization in Adrena (CVE-2026-65576)
CVE-2026-65575 Unsafe Deserialization in Accalia (CVE-2026-65575)
CVE-2026-65579 Unsafe Deserialization in Agricola (CVE-2026-65579)
CVE-2026-65581 Unsafe Deserialization in AI ANN (CVE-2026-65581)
CVE-2026-65574 Unsafe Deserialization in Abogado (CVE-2026-65574)
CVE-2026-65573 Unsafe Deserialization in Abelle (CVE-2026-65573)
CVE-2026-65572 Unsafe Deserialization in A.Williams (CVE-2026-65572)
CVE-2026-65571 Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
CVE-2026-65552 Unsafe Deserialization in Export User Data (CVE-2026-65552)
CVE-2026-65556 Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
CVE-2026-65549 Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
CVE-2026-28139 Unsafe Deserialization in Ajax Search Lite (CVE-2026-28139)
CVE-2026-66909 Unsafe Deserialization in Apache (CVE-2026-66909)
CVE-2026-70426 In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...
CVE-2026-71294 Unsafe Deserialization in Cotonti CMS (CVE-2026-71294)
CVE-2026-71281 Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines...
CVE-2026-61484 Unsafe Deserialization in Apache (CVE-2026-61484)
CVE-2026-70554 Unsafe Deserialization in MaxSite CMS (CVE-2026-70554)
CVE-2026-47623 Unsafe Deserialization in NVIDIA Dynamo for Linux (CVE-2026-47623)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details