Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2026-106558 Unsafe Deserialization in @backstage/plugin-techdocs-node (CVE-2026-106558)
CVE-2026-105192 Vulnerability in lmcache (CVE-2026-105192)
CVE-2026-107104 Unsafe Deserialization in ERP system (CVE-2026-107104)
CVE-2025-64393 Unsafe Deserialization in Veeam Backup & Replication (CVE-2025-64393)
CVE-2026-97188 Unsafe Deserialization in String locator (WordPress plugin) (CVE-2026-97188)
CVE-2026-93447 Unsafe Deserialization in Langflow (CVE-2026-93447)
CVE-2026-65142 Unsafe Deserialization in NVIDIA Model-Optimizer (CVE-2026-65142)
CVE-2026-76750 Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking...
CVE-2026-103831 Unsafe Deserialization in TrueLayer Magento 2 Plugin (CVE-2026-103831)
CVE-2026-39797 Unsafe Deserialization in GDPR Framework By Data443 (CVE-2026-39797)
CVE-2026-104747 Unsafe Deserialization in Haaken (CVE-2026-104747)
CVE-2026-82988 Authentication Bypass in ViewSonic ViewBoard (CVE-2026-82988)
CVE-2026-97257 Unsafe Deserialization in Simple Event Planner (CVE-2026-97257)
CVE-2026-93617 Unsafe Deserialization in Sunshine Photo Cart (CVE-2026-93617)
CVE-2026-103348 Unsafe Deserialization in WP Ultimate Exporter (CVE-2026-103348)
CVE-2026-100511 Unsafe Deserialization in VK Google Job Posting Manager (CVE-2026-100511)
CVE-2026-100506 Unsafe Deserialization in WP Spell Check (CVE-2026-100506)
CVE-2026-97283 Unsafe Deserialization in Advanced Post Manager (CVE-2026-97283)
CVE-2026-103349 Unsafe Deserialization in Product Feed PRO for WooCommerce (CVE-2026-103349)
CVE-2026-104905 Unsafe Deserialization in FacturaScripts (CVE-2026-104905)
CVE-2026-37719 An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary...
CVE-2017-20285 Vulnerability in YAML (CVE-2017-20285)
CVE-2019-25777 Unsafe Deserialization in YAML (CVE-2019-25777)
CVE-2026-20340 Unsafe Deserialization in Cisco Secure FMC Software (CVE-2026-20340)
CVE-2026-20242 Unsafe Deserialization in Cisco Secure Firewall Management Center (FMC) Software (CVE-2026-20242)
CVE-2026-100308 Vulnerability in Amazon GluonTS (CVE-2026-100308)
CVE-2026-103877 Unsafe Deserialization in Apache (CVE-2026-103877)
CVE-2026-55083 Unsafe Deserialization in DHIS2 (CVE-2026-55083)
CVE-2026-12544 Unsafe Deserialization in Foreman (CVE-2026-12544)
CVE-2026-97284 Unsafe Deserialization in Icegram (CVE-2026-97284)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details