CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-37502 | WordPress plugin WooCommerce Social Login 安全漏洞 — WooCommerce Social Login | 5.4 | Medium | 2024-07-09 |
| CVE-2024-6525 | D-Link DAR-7000 代码问题漏洞 — DAR-7000 | 2.7 | Low | 2024-07-05 |
| CVE-2024-6441 | ORIPA 代码问题漏洞 — ORIPA | 6.3 | Medium | 2024-07-02 |
| CVE-2024-36984 | Splunk 安全漏洞 — Splunk Enterprise | 8.8 | High | 2024-07-01 |
| CVE-2024-29040 | tpm2-tss 安全漏洞 — tpm2-tss | 4.3 | Medium | 2024-06-28 |
| CVE-2024-5016 | Progress Software WhatsUp Gold 安全漏洞 — WhatsUp Gold | 7.2 | High | 2024-06-25 |
| CVE-2024-35780 | WordPress plugin Page Builder: Live Composer 代码问题漏洞 — Page Builder: Live Composer | 8.5 | High | 2024-06-19 |
| CVE-2024-5649 | WordPress plugin Universal Slider 安全漏洞 — Universal Slider | 5.4 | Medium | 2024-06-19 |
| CVE-2024-5724 | WordPress plugin Photo Video Gallery Master 安全漏洞 — Photo Video Gallery Master | 8.8 | High | 2024-06-19 |
| CVE-2024-5871 | WordPress Plugin WooCommerce - Social Login 安全漏洞 — WooCommerce - Social Login | 9.8 | Critical | 2024-06-15 |
| CVE-2024-5671 | Trellix IPS Manager 代码问题漏洞 — Intrusion Prevention System (IPS) Manager | 9.8 | Critical | 2024-06-14 |
| CVE-2024-4371 | WordPress plugin CoDesigner WooCommerce Builder for Elementor 安全漏洞 — CoDesigner – All in One Elementor WooCommerce Builder | 9.0 | Critical | 2024-06-13 |
| CVE-2024-3468 | OSIsoft PI Web API 代码问题漏洞 — PI Web API | 8.8AI | High AI | 2024-06-12 |
| CVE-2024-3467 | Osisoft PI Asset Framework 代码问题漏洞 — PI Asset Framework Client | 8.8AI | High AI | 2024-06-12 |
| CVE-2024-28964 | Dell Common Event Enabler 代码问题漏洞 — Common Event Enabler | 7.8 | High | 2024-06-12 |
| CVE-2024-35249 | Microsoft Dynamics 365 代码问题漏洞 — Microsoft Dynamics 365 Business Central 2023 Release Wave 1 | 8.8 | High | 2024-06-11 |
| CVE-2024-5675 | Mentor 代码问题漏洞 — Mentor – Employee Portal | 10.0 | Critical | 2024-06-06 |
| CVE-2024-37065 | Skops 安全漏洞 — Skops | 7.8 | High | 2024-06-04 |
| CVE-2024-37064 | ydata-profiling 安全漏洞 — ydata-profiling | 7.8 | High | 2024-06-04 |
| CVE-2024-37062 | ydata-profiling 安全漏洞 — ydata-profiling | 7.8 | High | 2024-06-04 |
| CVE-2024-37060 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37059 | Mlflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37058 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37057 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37056 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37055 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37054 | MLflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37053 | Mlflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-37052 | Mlflow 安全漏洞 — MLflow | 8.8 | High | 2024-06-04 |
| CVE-2024-3300 | Dassault Systèmes DELMIA Apriso 安全漏洞 — DELMIA Apriso | 9.0 | Critical | 2024-05-30 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。