Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-25551 Unsafe Deserialization in Seagull Software BarTender 2021 R1 (CVE-2026-25551)
CVE-2026-50076 Unsafe Deserialization in org.apache.fory:fory-core (CVE-2026-50076)
CVE-2026-7888 Unsafe Deserialization in concrete5/concrete5 (CVE-2026-7888)
CVE-2026-47065 Unsafe Deserialization in org.apache.mina:mina-core (CVE-2026-47065)
CVE-2026-42211 Unsafe Deserialization in react-router (CVE-2026-42211)
CVE-2026-34993 Unsafe Deserialization in aiohttp (CVE-2026-34993)
CVE-2026-24221 Unsafe Deserialization in NVIDIA NVTabular (CVE-2026-24221)
CVE-2026-24237 Unsafe Deserialization in NVIDIA NVTabular (CVE-2026-24237)
CVE-2026-39555 Unsafe Deserialization in Askka (CVE-2026-39555)
CVE-2026-39550 Unsafe Deserialization in Aperitif (CVE-2026-39550)
CVE-2026-39551 Unsafe Deserialization in Töbel (CVE-2026-39551)
CVE-2026-10566 Vulnerability in metagpt (CVE-2026-10566)
CVE-2026-9319 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-9319)
CVE-2026-9330 Unsafe Deserialization in IBM WebSphere Application Server (CVE-2026-9330)
CVE-2026-49121 Unsafe Deserialization in AI Tensor Engine for ROCm (CVE-2026-49121)
CVE-2026-38950 Unsafe Deserialization in ESA AnomalyMatch (CVE-2026-38950)
CVE-2026-10532 Unsafe Deserialization in ch.qos.logback:logback-core (CVE-2026-10532)
CVE-2026-7858 A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release...
CVE-2026-45360 Unsafe Deserialization in apache-airflow (CVE-2026-45360)
CVE-2026-42359 Unsafe Deserialization in apache-airflow (CVE-2026-42359)
CVE-2026-10042 manga-image-translator contains a remote code execution vulnerability in the shared API server...
CVE-2025-11993 Unsafe Deserialization in WooCommerce Infinite Scroll and Ajax Pagination (WordPress plugin) (CVE-2025-11993)
CVE-2026-9828 Unsafe Deserialization in ch.qos.logback:logback-core (CVE-2026-9828)
CVE-2026-37579 Unsafe Deserialization in SMSGate sms-core (CVE-2026-37579)
CVE-2026-45077 Unsafe Deserialization in symfony/monolog-bridge (CVE-2026-45077)
CVE-2026-47161 Unsafe Deserialization in RELATE (CVE-2026-47161)
CVE-2026-45162 Unsafe Deserialization in pimcore/pimcore (CVE-2026-45162)
CVE-2026-48917 Unsafe Deserialization in org.jenkins-ci.plugins:ldap (CVE-2026-48917)
CVE-2026-48919 Unsafe Deserialization in org.jenkins-ci.plugins:active-directory (CVE-2026-48919)
CVE-2026-24162 Unsafe Deserialization in NVIDIA Transformers4Rec for Linux (CVE-2026-24162)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details