CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-2433 | WordPress plugin WordPress Infinite Scroll – Ajax Load More 代码问题漏洞 — Ajax Load More – Infinite Scroll, Load More, & Lazy Load | 7.5 | High | 2022-09-06 |
| CVE-2022-2830 | Bitdefender GravityZone 代码问题漏洞 — GravityZone Console On-Premise | 8.8 | High | 2022-09-05 |
| CVE-2022-29063 | Apache OFBiz 代码问题漏洞 — Apache OFBiz | 9.8 | - | 2022-09-02 |
| CVE-2022-37023 | Apache Geode 代码问题漏洞 — Apache Geode | 8.8 | - | 2022-08-31 |
| CVE-2022-37022 | Apache Geode 代码问题漏洞 — Apache Geode | 9.8 | - | 2022-08-31 |
| CVE-2022-37021 | Apache Geode 代码问题漏洞 — Apache Geode | 9.8 | - | 2022-08-31 |
| CVE-2022-34668 | NVIDIA NVFLARE 代码问题漏洞 — NVIDIA FLARE | 9.8 | Critical | 2022-08-29 |
| CVE-2022-2465 | Rockwell Automation ISaGRAF Workbench 代码问题漏洞 — ISaGRAF Workbench | 8.6 | High | 2022-08-25 |
| CVE-2021-25642 | Apache Hadoop 代码问题漏洞 — Apache Hadoop | 8.8 | - | 2022-08-25 |
| CVE-2021-4178 | Kubernetes 代码问题漏洞 — kubernetes-client | 6.7 | - | 2022-08-24 |
| CVE-2022-2886 | Laravel 代码问题漏洞 — Laravel | 5.0 | Medium | 2022-08-19 |
| CVE-2022-2870 | Laravel 代码问题漏洞 — laravel | 4.1 | Medium | 2022-08-17 |
| CVE-2022-36006 | Arvados 代码问题漏洞 — arvados | 7.9 | High | 2022-08-14 |
| CVE-2022-33947 | F5 BIG-IP 代码问题漏洞 — BIG-IP DNS | 5.4 | Medium | 2022-08-04 |
| CVE-2022-28684 | DevExpress 代码问题漏洞 — DevExpress | 8.8 | - | 2022-08-03 |
| CVE-2022-35223 | EasyUse MailHunter Ultimate 代码问题漏洞 — MailHunter Ultimate | 9.8 | Critical | 2022-08-02 |
| CVE-2022-35872 | Inductive Automation Ignition 代码问题漏洞 — Ignition | 7.8 | - | 2022-07-25 |
| CVE-2022-35870 | Inductive Automation Ignition 代码问题漏洞 — Ignition | 8.4 | - | 2022-07-25 |
| CVE-2022-33318 | Mitsubishi Electric MC Works64 代码问题漏洞 — GENESIS64 | 9.8 | Critical | 2022-07-20 |
| CVE-2022-33320 | Mitsubishi Electric MC Works64 代码问题漏洞 — GENESIS64 | 7.8 | High | 2022-07-20 |
| CVE-2022-33315 | Mitsubishi Electric MC Works64和ICONICS GENESIS64 代码问题漏洞 — GENESIS64 | 7.8 | High | 2022-07-20 |
| CVE-2022-33316 | Mitsubishi Electric MC Works64 和 ICONICS GENESIS64 代码问题漏洞 — GENESIS64 | 7.8 | High | 2022-07-20 |
| CVE-2022-27580 | Safety 代码问题漏洞 — SICK Safety Designer | 7.8 | - | 2022-07-19 |
| CVE-2022-27579 | SICK Flexi Soft Designer 代码问题漏洞 — SICK Flexi Soft Designer | 7.8 | - | 2022-07-19 |
| CVE-2022-1984 | HYPR 代码问题漏洞 — HYPR Windows WFA | 4.5 | Medium | 2022-07-19 |
| CVE-2022-24082 | Pegasystem PEGA Platform 代码问题漏洞 — Pega Infinity | 9.8 | - | 2022-07-19 |
| CVE-2022-2437 | WordPress plugin Feed Them Social 代码问题漏洞 — Feed Them Social – Social Media Feeds, Video, and Photo Galleries | 9.8 | Critical | 2022-07-18 |
| CVE-2022-2444 | WordPress plugin Visualizer 代码问题漏洞 — Visualizer: Tables and Charts Manager for WordPress | 8.8 | High | 2022-07-18 |
| CVE-2022-31605 | NVIDIA NVFLARE 代码问题漏洞 — NVIDIA FLARE | 9.8 | Critical | 2022-07-01 |
| CVE-2022-31604 | NVIDIA NVFLARE 代码问题漏洞 — NVIDIA FLARE | 9.8 | Critical | 2022-07-01 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。