Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,303
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799

🛡 Vulnerabilities tagged with this 1,305

Image ID Title
CVE-2026-13046 Unsafe Deserialization in WatchGuard Fireware OS's SAML single sign-on (CVE-2026-13046)
CVE-2026-103040 Unsafe Deserialization in LightLLM (CVE-2026-103040)
CVE-2026-103041 Unsafe Deserialization in LightLLM (CVE-2026-103041)
CVE-2026-101169 In affected versions of Octopus Server, an authenticated user with permissions to edit an...
CVE-2026-81867 Unsafe Deserialization in Google Cloud Application Integration (CVE-2026-81867)
CVE-2026-82384 Unsafe Deserialization in Apache (CVE-2026-82384)
CVE-2026-86841 Unsafe Deserialization in Online Scheduling and Appointment Booking System (WordPress plugin) (CVE-2026-86841)
CVE-2026-100846 Unsafe Deserialization in MONAI (CVE-2026-100846)
CVE-2026-100845 Unsafe Deserialization in MONAI (CVE-2026-100845)
CVE-2026-100843 Unsafe Deserialization in MONAI (CVE-2026-100843)
CVE-2026-100841 Unsafe Deserialization in MONAI (CVE-2026-100841)
CVE-2026-97869 Vulnerability in langchain4j (CVE-2026-97869)
CVE-2026-84862 Unsafe Deserialization in IBM Guardium Data Protection (CVE-2026-84862)
CVE-2026-97865 Vulnerability in Open-Web-Analytics (CVE-2026-97865)
CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names…
CVE-2026-63630 BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the…
CVE-2026-82093 Unsafe Deserialization in IBM DataStage on Cloud Pak for Data (CVE-2026-82093)
CVE-2026-80513 Unsafe Deserialization in wpForo Forum (WordPress plugin) (CVE-2026-80513)
CVE-2026-95603 Unsafe Deserialization in Reycob Product Import Export (CVE-2026-95603)
CVE-2026-96775 Unsafe Deserialization in MLflow (CVE-2026-96775)
CVE-2026-96804 Unsafe Deserialization in MLflow (CVE-2026-96804)
CVE-2026-18490 Unsafe Deserialization in Ibm Financial Transaction Manager (CVE-2026-18490)
CVE-2026-96560 Unsafe Deserialization in LightLLM (CVE-2026-96560)
CVE-2026-95928 Vulnerability in recommenders-team recommenders (CVE-2026-95928)
CVE-2026-95897 Vulnerability in Dask (CVE-2026-95897)
CVE-2026-18163 Unsafe Deserialization in Ibm Financial Transaction Manager (CVE-2026-18163)
CVE-2026-17637 Unsafe Deserialization in Ibm Financial Transaction Manager (CVE-2026-17637)
CVE-2026-67615 Vulnerability in openEQUELLA (CVE-2026-67615)
CVE-2026-28325 SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code...
CVE-2026-43642 Unsafe Deserialization in Softaculous Virtualizor (CVE-2026-43642)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details