CWE-502 可信数据的反序列化 类弱点 2188 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-502 指反序列化不可信数据漏洞，属于数据验证缺陷。攻击者通过构造恶意序列化对象，在系统反序列化时触发任意代码执行或拒绝服务。开发者应避免直接反序列化外部输入，改用 JSON 等安全格式，或实施严格的类白名单校验与完整性检查，确保反序列化过程仅处理预期类型，从而阻断恶意载荷执行。
try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-31115 | opensearch-ruby 代码问题漏洞 — opensearch-ruby | 8.8 | High | 2022-06-30 |
| CVE-2022-29615 | SAP NetWeaver Developer Studio 代码问题漏洞 — SAP NetWeaver Developer Studio (NWDS) | 6.5 | - | 2022-06-14 |
| CVE-2022-29875 | 多款Siemens 产品代码问题漏洞 — Biograph Horizon PET/CT Systems | 9.8 | - | 2022-06-01 |
| CVE-2022-1660 | 多款Keysight Technologies产品代码问题漏洞 — N6854A Geolocation server and N6841A RF Sensor software | 9.8 | Critical | 2022-05-31 |
| CVE-2021-32935 | Cognex In-Sight OPC Server 代码问题漏洞 — In-Sight OPC Server | 8.8 | High | 2022-05-23 |
| CVE-2022-1118 | Rockwell Automation Connected Components Workbench 代码问题漏洞 — Connected Component Workbench | 8.6 | High | 2022-05-17 |
| CVE-2022-0573 | JFrog Artifactory 代码问题漏洞 — JFrog Artifactory | 8.8 | High | 2022-05-16 |
| CVE-2022-1463 | WordPress plugin Booking Calendar 代码问题漏洞 — Booking Calendar | 8.8 | High | 2022-05-10 |
| CVE-2021-21956 | CloudLinux Imunify360 代码问题漏洞 — Imunify360 | 8.4 | - | 2022-04-14 |
| CVE-2022-23450 | Siemens SIMATIC 代码问题漏洞 — SIMATIC Energy Manager Basic | 9.8 | - | 2022-04-12 |
| CVE-2022-20763 | Cisco Webex Meetings 代码问题漏洞 — Cisco Webex Meetings | 5.4 | Medium | 2022-04-06 |
| CVE-2022-1032 | Crater Invoice Crater 代码问题漏洞 — crater-invoice/crater | 7.2 | - | 2022-03-29 |
| CVE-2019-6834 | Schneider Electric Software Update 代码问题漏洞 — Software Update (SESU) – SUT Service component | 7.3 | High | 2022-03-28 |
| CVE-2021-27475 | Rockwell Automation Connected Components Workbench 代码问题漏洞 — Connected Components Workbench | 8.6 | High | 2022-03-23 |
| CVE-2021-27470 | Rockwell Automation FactoryTalk AssetCentre 代码问题漏洞 — FactoryTalk AssetCentre | 10.0 | Critical | 2022-03-23 |
| CVE-2021-27466 | Rockwell Automation FactoryTalk AssetCentre 代码问题漏洞 — FactoryTalk AssetCentre | 10.0 | Critical | 2022-03-23 |
| CVE-2021-27462 | Rockwell Automation FactoryTalk AssetCentre 代码问题漏洞 — FactoryTalk AssetCentre | 10.0 | Critical | 2022-03-23 |
| CVE-2021-27460 | Rockwell Automation FactoryTalk AssetCentre 代码问题漏洞 — FactoryTalk AssetCentre | 10.0 | Critical | 2022-03-23 |
| CVE-2022-24282 | Siemens SINEC NMS 代码问题漏洞 — SINEC NMS | 7.2 | High | 2022-03-08 |
| CVE-2022-21828 | Incapptic Connect 安全漏洞 — Ivanti Incapptic Connect | 7.2 | - | 2022-03-04 |
| CVE-2022-0138 | Airspan Networks Mmp 代码问题漏洞 — MMP | 7.5 | High | 2022-02-18 |
| CVE-2022-24289 | Apache Cayenne 代码问题漏洞 — Apache Cayenne | 8.8 | - | 2022-02-11 |
| CVE-2022-23307 | Apache Log4j 代码问题漏洞 — Apache Log4j 1.x | 9.8 | - | 2022-01-18 |
| CVE-2022-23302 | Apache Log4j 代码问题漏洞 — Apache Log4j 1.x | 8.8 | - | 2022-01-18 |
| CVE-2021-43297 | Apache Dubbo 代码问题漏洞 — Apache Dubbo | 9.8 | - | 2022-01-10 |
| CVE-2021-42392 | H2database代码问题漏洞 — h2 | 9.8 | - | 2022-01-07 |
| CVE-2022-21647 | CodeIgniter 代码问题漏洞 — CodeIgniter4 | 7.7 | High | 2022-01-04 |
| CVE-2021-20318 | Red Hat Jboss Enterprise Application Platform 7 代码问题漏洞 — Artemis in EAP 7 | 7.2 | - | 2021-12-23 |
| CVE-2021-4118 | Pytorch-Lightning 代码问题漏洞 — pytorchlightning/pytorch-lightning | 7.8 | - | 2021-12-23 |
| CVE-2021-36336 | Dell Wyse Management Suite代码问题漏洞 — Wyse Management Suite | 9.8 | Critical | 2021-12-21 |
CWE-502（可信数据的反序列化） 是常见的弱点类别，本平台收录该类弱点关联的 2188 条 CVE 漏洞。