CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-3301 | Dassault Systèmes DELMIA Apriso 安全漏洞 — DELMIA Apriso | 8.5 | High | 2024-05-30 |
| CVE-2024-26289 | PMB 安全漏洞 — PMB | 9.8 | Critical | 2024-05-27 |
| CVE-2024-5352 | AJ-Report 代码问题漏洞 — AJ-Report | 6.3 | Medium | 2024-05-26 |
| CVE-2024-5351 | AJ-Report 安全漏洞 — AJ-Report | 6.3 | Medium | 2024-05-26 |
| CVE-2024-5085 | WordPress plugin Hash Form Drag Drop Form Builder 安全漏洞 — Hash Form – Drag & Drop Form Builder | 8.1 | High | 2024-05-23 |
| CVE-2024-4471 | WordPress plugin 140+ Widgets Best Addons For Elementor–FREE 安全漏洞 — Xpro Addons — 140+ Widgets for Elementor | 8.0 | High | 2024-05-23 |
| CVE-2024-4157 | WordPress plugin Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder 安全漏洞 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 7.5 | High | 2024-05-22 |
| CVE-2024-31879 | IBM i 代码问题漏洞 — i | 7.5 | High | 2024-05-18 |
| CVE-2024-4733 | WordPress plugin ShiftController Employee Shift Scheduling 安全漏洞 — ShiftController Employee Shift Scheduling | 7.5 | High | 2024-05-16 |
| CVE-2024-34751 | WordPress Plugin Order Export & Order Import for WooCommerce 代码问题漏洞 — Order Export & Order Import for WooCommerce | 4.4 | Medium | 2024-05-16 |
| CVE-2024-4838 | WordPress Plugin ConvertPlus 安全漏洞 — ConvertPlus | 7.5 | High | 2024-05-16 |
| CVE-2024-4200 | Progress Software Telerik Report Server 安全漏洞 — Telerik Reporting | 7.7 | High | 2024-05-15 |
| CVE-2024-3483 | NetIQ iManager 安全漏洞 — iManager | 7.8 | High | 2024-05-15 |
| CVE-2024-3967 | NetIQ iManager 安全漏洞 — iManager | 7.6 | High | 2024-05-15 |
| CVE-2024-30042 | Microsoft Excel 代码问题漏洞 — Office Online Server | 7.8 | High | 2024-05-14 |
| CVE-2024-30044 | Microsoft SharePoint 代码问题漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.2 | High | 2024-05-14 |
| CVE-2024-4413 | WordPress plugin Hotel Booking Lite 安全漏洞 — MotoPress Hotel Booking | 9.8 | Critical | 2024-05-10 |
| CVE-2023-38264 | IBM SDK, Java Technology Edition 安全漏洞 — SDK, Java Technology Edition | 5.9 | Medium | 2024-05-10 |
| CVE-2024-4044 | NI InstrumentStudio 代码问题漏洞 — FlexLogger | 7.8 | High | 2024-05-10 |
| CVE-2024-4699 | D-Link DAR-8000 代码问题漏洞 — DAR-8000-10 | 6.3 | Medium | 2024-05-10 |
| CVE-2024-2290 | WordPress plugin Advanced Ads 安全漏洞 — Advanced Ads – Ad Manager & AdSense | 7.2 | High | 2024-05-09 |
| CVE-2024-3070 | WordPress plugin Last Viewed Posts by WPBeginner 安全漏洞 — Last Viewed Posts by WPBeginner | 9.8 | Critical | 2024-05-09 |
| CVE-2024-3954 | WordPress plugin Ditty 安全漏洞 — Ditty – Responsive News Tickers, Sliders, and Lists | 8.8 | High | 2024-05-09 |
| CVE-2024-28075 | SolarWinds Access Rights Manager 代码问题漏洞 — Access Rights Manager | 9.0 | Critical | 2024-05-09 |
| CVE-2024-34433 | WordPress plugin One Click Demo Import 代码问题漏洞 — One Click Demo Import | 4.4 | Medium | 2024-05-09 |
| CVE-2024-4606 | WordPress plugin Ultimate Store Kit Elementor Addons 代码问题漏洞 — Ultimate Store Kit Elementor Addons | 5.4 | Medium | 2024-05-09 |
| CVE-2024-29800 | WordPress plugin Timber 代码问题漏洞 — Timber | 8.0 | High | 2024-05-09 |
| CVE-2024-22460 | Dell DM5500 代码问题漏洞 — Data Manager Appliance Software (DMAS) | 2.2 | Low | 2024-05-08 |
| CVE-2024-26579 | Apache InLong 代码问题漏洞 — Apache InLong | 9.8AI | Critical AI | 2024-05-08 |
| CVE-2024-3240 | WordPress Plugin ConvertPlug 安全漏洞 — ConvertPlus | 8.8 | High | 2024-05-04 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。