Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2026-96186 Unsafe Deserialization in Microsoft Windows Media Foundation (CVE-2026-96186)
CVE-2026-88091 Unsafe Deserialization in Microsoft Windows Management Instrumentation (CVE-2026-88091)
CVE-2026-87692 Unsafe Deserialization in Microsoft Exchange Server (CVE-2026-87692)
CVE-2026-85900 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-85900)
CVE-2026-105013 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-105013)
CVE-2026-100214 Unsafe Deserialization in Microsoft Dynamics Business Central (CVE-2026-100214)
CVE-2026-65180 Unsafe Deserialization in NVIDIA Megatron-LM (CVE-2026-65180)
CVE-2026-65110 Unsafe Deserialization in NVIDIA Megatron-LM (CVE-2026-65110)
CVE-2026-108958 Vulnerability in TensorLayer (CVE-2026-108958)
CVE-2026-108947 Vulnerability in yoshitomo-matsubara torchdistill (CVE-2026-108947)
CVE-2026-109237 Unsafe Deserialization in Crawl4AI (CVE-2026-109237)
CVE-2026-109361 Unsafe Deserialization in MONAI (CVE-2026-109361)
CVE-2026-109360 Unsafe Deserialization in MONAI (CVE-2026-109360)
CVE-2026-109391 Square Squash through commit e73f280 contains an insecure deserialization vulnerability that...
CVE-2026-12613 Unsafe Deserialization in UYAP Document Editor (CVE-2026-12613)
CVE-2026-52903 Unsafe Deserialization in ManageIQ. The YamlLoadAliases (CVE-2026-52903)
CVE-2026-81797 Unsafe Deserialization in WordPress (CVE-2026-81797)
CVE-2026-78533 Unsafe Deserialization in Qwery (CVE-2026-78533)
CVE-2026-78535 Unsafe Deserialization in Photolia (CVE-2026-78535)
CVE-2026-66569 Unsafe Deserialization in Kicker (CVE-2026-66569)
CVE-2026-66567 Unsafe Deserialization in Anesta (CVE-2026-66567)
CVE-2026-78529 Unsafe Deserialization in Alliance (CVE-2026-78529)
CVE-2026-78531 Unsafe Deserialization in Jacqueline (CVE-2026-78531)
CVE-2026-66568 Unsafe Deserialization in Original (CVE-2026-66568)
CVE-2026-66565 Unsafe Deserialization in FC United (CVE-2026-66565)
CVE-2026-66563 Unsafe Deserialization in Windsor (CVE-2026-66563)
CVE-2026-66483 Unsafe Deserialization in Education Center (CVE-2026-66483)
CVE-2026-66482 Unsafe Deserialization in Drone Media (CVE-2026-66482)
CVE-2026-66564 Unsafe Deserialization in ShiftCV (CVE-2026-66564)
CVE-2026-62124 Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details