CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-51656 | Apache IoTDB 代码问题漏洞 — Apache IoTDB | 9.8AI | Critical AI | 2023-12-21 |
| CVE-2022-47599 | 编号已被CVE保留 — File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager | 5.5 | Medium | 2023-12-20 |
| CVE-2023-7018 | Hugging Face Transformers 代码问题漏洞 — huggingface/transformers | 9.8 | - | 2023-12-20 |
| CVE-2023-49773 | WordPress Plugin BCorp Shortcodes 代码问题漏洞 — BCorp Shortcodes | 10.0 | Critical | 2023-12-20 |
| CVE-2023-49772 | WordPress Plugin Genesis Simple Love 代码问题漏洞 — Genesis Simple Love | 10.0 | Critical | 2023-12-20 |
| CVE-2023-28782 | WordPress Plugin Gravity Forms 代码问题漏洞 — Gravity Forms | 8.3 | High | 2023-12-20 |
| CVE-2023-40555 | WordPress Plugin Flatsome 代码问题漏洞 — Flatsome | Multi-Purpose Responsive WooCommerce Theme | 8.3 | High | 2023-12-20 |
| CVE-2023-46147 | WordPress Plugin Themify 代码问题漏洞 — Themify Ultra | 7.4 | High | 2023-12-20 |
| CVE-2023-47507 | WordPress Plugin Master Slider 代码问题漏洞 — Master Slider Pro | 7.1 | High | 2023-12-20 |
| CVE-2023-34027 | WordPress plugin Recently Viewed Products 代码问题漏洞 — Recently Viewed Products | 8.3 | High | 2023-12-19 |
| CVE-2023-34382 | WordPress plugin Dokan 代码问题漏洞 — Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | 4.4 | Medium | 2023-12-19 |
| CVE-2023-37390 | WordPress plugin Themesflat Addons For Elementor 代码问题漏洞 — Themesflat Addons For Elementor | 8.3 | High | 2023-12-19 |
| CVE-2023-6730 | Hugging Face Transformers 代码问题漏洞 — huggingface/transformers | 9.8 | - | 2023-12-19 |
| CVE-2023-46154 | WordPress Plugin E2Pdf 代码问题漏洞 — E2Pdf – Export To Pdf Tool for WordPress | 6.6 | Medium | 2023-12-18 |
| CVE-2023-49819 | WordPress Plugin Structured Content 代码问题漏洞 — Structured Content (JSON-LD) #wpsc | 7.5 | High | 2023-12-18 |
| CVE-2023-46279 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 9.8 | - | 2023-12-15 |
| CVE-2023-29234 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 9.8 | - | 2023-12-15 |
| CVE-2023-6656 | DeepFaceLab 代码问题漏洞 — DeepFaceLab | 5.0 | Medium | 2023-12-10 |
| CVE-2023-6654 | PHPEMS 代码问题漏洞 — PHPEMS | 6.3 | Medium | 2023-12-10 |
| CVE-2023-6580 | D-Link DIR-846 代码问题漏洞 — DIR-846 | 8.8 | High | 2023-12-07 |
| CVE-2023-49297 | PyDrive2 代码问题漏洞 — PyDrive2 | 3.3 | Low | 2023-12-05 |
| CVE-2023-46674 | Elasticsearch-hadoop 代码问题漏洞 — Elasticsearch-Hadoop | 6.0 | Medium | 2023-12-05 |
| CVE-2023-47207 | Delta Electronics InfraSuite Device Master 安全漏洞 — InfraSuite Device Master | 9.8 | Critical | 2023-11-30 |
| CVE-2023-46302 | Apache Submarine 安全漏洞 — Apache Submarine | 9.8AI | Critical AI | 2023-11-20 |
| CVE-2023-44351 | Adobe ColdFusion 安全漏洞 — ColdFusion | 9.8 | Critical | 2023-11-17 |
| CVE-2023-44353 | Adobe ColdFusion 安全漏洞 — ColdFusion | 9.8 | Critical | 2023-11-17 |
| CVE-2023-44350 | Adobe ColdFusion 安全漏洞 — ColdFusion | 9.8 | Critical | 2023-11-17 |
| CVE-2023-47130 | Yii 安全漏洞 — yii | 8.1 | High | 2023-11-14 |
| CVE-2023-36035 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2023-11-14 |
| CVE-2023-36039 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2016 Cumulative Update 23 | 8.0 | High | 2023-11-14 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。