Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-27053 Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
CVE-2026-39434 Unsafe Deserialization in CTX Feed (CVE-2026-39434)
CVE-2026-27333 Unsafe Deserialization in Paid Videochat Turnkey Site (CVE-2026-27333)
CVE-2026-39006 Vulnerability in org.snmp4j:snmp4j-agent (CVE-2026-39006)
CVE-2026-11860 Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring...
CVE-2026-12191 Vulnerability in deserialization (CVE-2026-12191)
CVE-2026-50632 Vulnerability in org.apache.cxf:cxf-rt-transports-jms (CVE-2026-50632)
CVE-2026-50633 Vulnerability in org.apache.cxf:cxf-integration-jca (CVE-2026-50633)
CVE-2025-27511 Vulnerability in org.geoserver.extension:gs-db2 (CVE-2025-27511)
CVE-2026-41699 Unsafe Deserialization in org.springframework.graphql:spring-graphql (CVE-2026-41699)
CVE-2026-20251 Unsafe Deserialization in Splunk Enterprise (CVE-2026-20251)
CVE-2026-53435 Unsafe Deserialization in jenkins (CVE-2026-53435)
CVE-2026-52751 Unsafe Deserialization in Ghidra (CVE-2026-52751)
CVE-2026-10721 Unsafe Deserialization in concrete5/concrete5 (CVE-2026-10721)
CVE-2026-11815 An attacker who intercepts and tampers with traffic between the client application and the API...
CVE-2026-41731 Unsafe Deserialization in org.springframework.kafka:spring-kafka (CVE-2026-41731)
CVE-2026-41732 Unsafe Deserialization in org.springframework.pulsar:spring-pulsar (CVE-2026-41732)
CVE-2026-40993 Unsafe Deserialization in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-40993)
CVE-2026-44963 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated...
CVE-2026-45484 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-45484)
CVE-2026-26142 Unsafe Deserialization in Nuance PowerScribe (CVE-2026-26142)
CVE-2026-48560 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-48560)
CVE-2026-49740 Unsafe Deserialization in typo3/cms-core (CVE-2026-49740)
CVE-2026-8365 Unsafe Deserialization in Blocksy (WordPress theme) (CVE-2026-8365)
CVE-2026-41855 Unsafe Deserialization in org.springframework:spring-jms (CVE-2026-41855)
CVE-2026-45034 Unsafe Deserialization in phpoffice/phpspreadsheet (CVE-2026-45034)
CVE-2026-7566 Unsafe Deserialization in LearnPress – Backup & Migration Tool (WordPress plugin) (CVE-2026-7566)
CVE-2026-7654 Unsafe Deserialization in Admin Columns (WordPress plugin) (CVE-2026-7654)
CVE-2026-50589 Vulnerability in ironic (CVE-2026-50589)
CVE-2026-25550 Vulnerability in TCP port (CVE-2026-25550)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details