CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-43141 | WordPress plugin Participants Database 代码问题漏洞 — Participants Database | 9.8 | Critical | 2024-08-13 |
| CVE-2024-7560 | WordPress theme News Flash 安全漏洞 — News Flash | 7.2 | High | 2024-08-08 |
| CVE-2024-7486 | WordPress theme MultiPurpose 安全漏洞 — MultiPurpose | 8.8 | High | 2024-08-08 |
| CVE-2024-7561 | WordPress theme The Next 安全漏洞 — The Next | 8.8 | High | 2024-08-08 |
| CVE-2024-39636 | WordPress plugin Better Find and Replace 代码问题漏洞 — Better Find and Replace | 8.3 | High | 2024-08-01 |
| CVE-2024-39630 | WordPress plugin Timetable and Event Schedule 代码问题漏洞 — Timetable and Event Schedule | 5.5 | Medium | 2024-08-01 |
| CVE-2024-6152 | WordPress plugin Flipbox Builder 安全漏洞 — Flipbox Builder | 8.8 | High | 2024-07-27 |
| CVE-2024-39673 | Huawei EMUI和Huawei HarmonyOS 安全漏洞 — HarmonyOS | 6.8 | Medium | 2024-07-25 |
| CVE-2024-7067 | kirilkirkov Ecommerce-Laravel-Bootstrap 代码问题漏洞 — Ecommerce-Laravel-Bootstrap | 6.3 | Medium | 2024-07-24 |
| CVE-2024-6327 | Progress Software Telerik Report Server 安全漏洞 — Telerik Report Server | 9.9 | Critical | 2024-07-24 |
| CVE-2024-6794 | NI VeriStand 安全漏洞 — VeriStand | 9.8 | Critical | 2024-07-22 |
| CVE-2024-6793 | NI VeriStand 安全漏洞 — VeriStand | 9.8 | Critical | 2024-07-22 |
| CVE-2024-6675 | NI VeriStand 安全漏洞 — VeriStand | 7.8 | High | 2024-07-22 |
| CVE-2024-38759 | WordPress plugin Search & Replace 代码问题漏洞 — Search & Replace | 5.4 | Medium | 2024-07-22 |
| CVE-2024-6960 | H2O 安全漏洞 | 7.5 | High | 2024-07-21 |
| CVE-2024-6944 | ZhongBangKeJi CRMEB 代码问题漏洞 — CRMEB | 6.3 | Medium | 2024-07-21 |
| CVE-2024-6943 | ZhongBangKeJi CRMEB 代码问题漏洞 — CRMEB | 6.3 | Medium | 2024-07-21 |
| CVE-2024-5726 | WordPress plugin Timeline Event History 安全漏洞 — Timeline Event History | 8.8 | High | 2024-07-18 |
| CVE-2024-28074 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 9.6 | Critical | 2024-07-17 |
| CVE-2024-40624 | TorrentPier 安全漏洞 — torrentpier | 9.8 | Critical | 2024-07-15 |
| CVE-2023-49566 | Apache Linkis 代码问题漏洞 — Apache Linkis DataSource | 8.1 | - | 2024-07-15 |
| CVE-2023-46801 | Apache Linkis 代码问题漏洞 — Apache Linkis DataSource | 8.1 | - | 2024-07-15 |
| CVE-2024-6645 | Wukong_nocode 代码问题漏洞 — Wukong_nocode | 6.3 | Medium | 2024-07-10 |
| CVE-2024-6644 | ArgusDBM 代码问题漏洞 — ArgusDBM | 6.3 | Medium | 2024-07-10 |
| CVE-2024-38094 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-07-09 |
| CVE-2024-38023 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-07-09 |
| CVE-2024-38024 | Microsoft SharePoint 安全漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-07-09 |
| CVE-2023-32737 | Siemens SIMATIC STEP 代码问题漏洞 — SIMATIC STEP 7 Safety V18 | 6.3 | Medium | 2024-07-09 |
| CVE-2023-32735 | Siemens SIMATIC WinCC和SIMATIC STEP 代码问题漏洞 — SIMATIC STEP 7 Safety V16 | 6.5 | Medium | 2024-07-09 |
| CVE-2022-45147 | Siemens SIMATIC PCS和SIMATIC STEP 代码问题漏洞 — SIMATIC PCS neo V4.0 | 7.8 | High | 2024-07-09 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。