Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2025-7639 The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority -...
CVE-2026-66256 Unsafe Deserialization in Apache (CVE-2026-66256)
CVE-2026-28176 Unsafe Deserialization in Booking Activities (CVE-2026-28176)
CVE-2026-28149 Unsafe Deserialization in Headless Single Sign On (CVE-2026-28149)
CVE-2026-27380 Unsafe Deserialization in Car Rental Manager (CVE-2026-27380)
CVE-2026-67579 SQL Injection in Ash Hq (CVE-2026-67579)
CVE-2026-73325 Unsafe Deserialization in Fujitsu Research (CVE-2026-73325)
CVE-2026-67587 Unsafe Deserialization in apache-airflow (CVE-2026-67587)
CVE-2026-67260 Unsafe Deserialization in apache-airflow (CVE-2026-67260)
CVE-2026-59242 Unsafe Deserialization in apache-airflow (CVE-2026-59242)
CVE-2026-58076 Unsafe Deserialization in apache-airflow (CVE-2026-58076)
CVE-2026-68756 Unsafe Deserialization in Jfrog (CVE-2026-68756)
CVE-2026-18634 An insecure handling of serialized objects vulnerability was found in the one of the service of...
CVE-2026-59124 Unsafe Deserialization in Microsoft Windows App (CVE-2026-59124)
CVE-2026-35502 Unsafe Deserialization in Intel Extension For Pytorch (CVE-2026-35502)
CVE-2026-48397 Unsafe Deserialization in Adobe Windows (CVE-2026-48397)
CVE-2026-70321 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-70321)
CVE-2026-66808 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-66808)
CVE-2026-66805 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-66805)
CVE-2026-65815 Unsafe Deserialization in Microsoft Dynamics (CVE-2026-65815)
CVE-2026-65663 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-65663)
CVE-2026-65665 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-65665)
CVE-2026-65658 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-65658)
CVE-2026-64901 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-64901)
CVE-2026-63516 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-63516)
CVE-2026-63514 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-63514)
CVE-2026-62912 Unsafe Deserialization in Microsoft Exchange Server (CVE-2026-62912)
CVE-2026-17061 A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release...
CVE-2026-15555 Unsafe Deserialization in JBoss marshalling (CVE-2026-15555)
CVE-2026-18948 Unsafe Deserialization in Feast (CVE-2026-18948)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details