CWE-502 · 3.045 kayıt
Güvenilmeyen verinin çözümlenmesi
Neden olur?
Ağdan gelen veri, kaynağı doğrulanmadan dilin yerel nesne biçimine çözümleniyor. Çözümleme sırasında nesnenin içindeki kod yolları tetiklenebilir.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
payload = sock.recv(65536)job = pickle.loads(payload)Düzeltilmiş
payload = sock.recv(65536)if not hmac.compare_digest(sign(payload), header_sig): raise PermissionError("imza geçersiz")job = JobSchema.validate(json.loads(payload))Nasıl önlenir?
- 01Ağ mesajlarında yalnızca veri taşıyan biçimler (JSON gibi) kullanın.
- 02Mesajın kaynağını imza ya da karşılıklı TLS ile doğrulayın.
- 03Çözümlenen veriyi bir şemaya göre denetleyin.
Bu sınıftaki CVE’ler
3.045 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
100Hemen | CVE-2025-55182Silahlaştırılmış | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclufacebook · react · CWE-502 | Kritik10,0 | KEV | %99,8 | 3 Ara 2025 |
99Hemen | CVE-2021-35464Silahlaştırılmış | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.forgerock · access management · CWE-502 | Kritik9,8 | KEV | %100,0 | 22 Tem 2021 |
99Hemen | CVE-2025-53770Silahlaştırılmış | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Kritik9,8 | KEV | %100,0 | 19 Tem 2025 |
99Hemen | CVE-2023-29300Silahlaştırılmış | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionadobe · coldfusion · CWE-502 | Kritik9,8 | KEV | %100,0 | 12 Tem 2023 |
99Hemen | CVE-2025-59287Silahlaştırılmış | Windows Server Update Service (WSUS) Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-502 | Kritik9,8 | KEV | %100,0 | 14 Eki 2025 |
99Hemen | CVE-2022-47986Silahlaştırılmış | IBM Aspera Faspex code executionibm · aspera faspex · CWE-502 | Kritik9,8 | KEV | %100,0 | 17 Şub 2023 |
99Hemen | CVE-2018-2628Silahlaştırılmış | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).oracle · weblogic server · CWE-502 | Kritik9,8 | KEV | %100,0 | 18 Nis 2018 |
99Hemen | CVE-2020-10189Silahlaştırılmış | Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImagezohocorp · manageengine desktop central · CWE-502 | Kritik9,8 | KEV | %99,9 | 6 Mar 2020 |
99Hemen | CVE-2022-35405Silahlaştırılmış | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.zohocorp · manageengine access manager plus · CWE-502 | Kritik9,8 | KEV | %99,9 | 19 Tem 2022 |
99Hemen | CVE-2020-7961Silahlaştırılmış | Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web serliferay · liferay portal · CWE-502 | Kritik9,8 | KEV | %99,9 | 20 Mar 2020 |
99Hemen | CVE-2023-46604Silahlaştırılmış | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackapache · activemq · CWE-502 | Kritik9,8 | KEV | %99,9 | 27 Eki 2023 |
99Hemen | CVE-2019-18935Silahlaştırılmış | Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.telerik · ui for asp.net ajax · CWE-502 | Kritik9,8 | KEV | %99,7 | 11 Ara 2019 |
99Hemen | CVE-2017-1000353Silahlaştırılmış | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.jenkins · jenkins · CWE-502 | Kritik9,8 | KEV | %99,7 | 29 Oca 2018 |
98Hemen | CVE-2018-1000861Silahlaştırılmış | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/corjenkins · jenkins · CWE-502 | Kritik9,8 | KEV | %98,3 | 10 Ara 2018 |
98Hemen | CVE-2015-7450Silahlaştırılmış | Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products alloibm · sterling b2b integrator · CWE-502 | Kritik9,8 | KEV | %97,8 | 2 Oca 2016 |
98Hemen | CVE-2021-42237Silahlaştırılmış | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achisitecore · experience platform · CWE-502 | Kritik9,8 | KEV | %97,6 | 5 Kas 2021 |
98Hemen | CVE-2020-2555Silahlaştırılmış | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).oracle · access manager · CWE-502 | Kritik9,8 | KEV | %97,1 | 15 Oca 2020 |
98Hemen | CVE-2023-38203Silahlaştırılmış | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEadobe · coldfusion · CWE-502 | Kritik9,8 | KEV | %97,1 | 20 Tem 2023 |
98Hemen | CVE-2015-4852Silahlaştırılmış | The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitraryoracle · virtual desktop infrastructure · CWE-502 | Kritik9,8 | KEV | %96,0 | 18 Kas 2015 |
98Hemen | CVE-2019-10068Silahlaştırılmış | An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions.kentico · xperience · CWE-502 | Kritik9,8 | KEV | %95,1 | 26 Mar 2019 |
97Hemen | CVE-2025-24016Silahlaştırılmış | Remote code execution in Wazuh serverwazuh · wazuh · CWE-502 | Kritik9,9 | KEV | %93,8 | 10 Şub 2025 |
96Hemen | CVE-2017-12149Silahlaştırılmış | In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnredhat · jboss enterprise application platform · CWE-502 | Kritik9,8 | KEV | %90,7 | 4 Eki 2017 |
96Hemen | CVE-2017-3066Silahlaştırılmış | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializaadobe · coldfusion · CWE-502 | Kritik9,8 | KEV | %90,6 | 27 Nis 2017 |
96Hemen | CVE-2024-40711Silahlaştırılmış | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).veeam · veeam backup \& replication · CWE-502 | Kritik9,8 | KEV | %90,4 | 7 Eyl 2024 |
96Hemen | CVE-2026-63077Silahlaştırılmış | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocoljetbrains · teamcity · CWE-502 | Kritik9,8 | KEV | %89,6 | 27 Tem 2026 |
- CVE-2025-55182100Hemen
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100facebook · react3 Ara 2025
- CVE-2021-3546499Hemen
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100forgerock · access management22 Tem 2021
- CVE-2025-5377099Hemen
Microsoft SharePoint Server Remote Code Execution Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100microsoft · sharepoint server19 Tem 2025
- CVE-2023-2930099Hemen
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100adobe · coldfusion12 Tem 2023
- CVE-2025-5928799Hemen
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100microsoft · windows server 201214 Eki 2025
- CVE-2022-4798699Hemen
IBM Aspera Faspex code execution
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100ibm · aspera faspex17 Şub 2023
- CVE-2018-262899Hemen
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100oracle · weblogic server18 Nis 2018
- CVE-2020-1018999Hemen
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100zohocorp · manageengine desktop central6 Mar 2020
- CVE-2022-3540599Hemen
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100zohocorp · manageengine access manager plus19 Tem 2022
- CVE-2020-796199Hemen
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100liferay · liferay portal20 Mar 2020
- CVE-2023-4660499Hemen
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100apache · activemq27 Eki 2023
- CVE-2019-1893599Hemen
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100telerik · ui for asp.net ajax11 Ara 2019
- CVE-2017-100035399Hemen
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100jenkins · jenkins29 Oca 2018
- CVE-2018-100086198Hemen
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cor
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98jenkins · jenkins10 Ara 2018
- CVE-2015-745098Hemen
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allo
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98ibm · sterling b2b integrator2 Oca 2016
- CVE-2021-4223798Hemen
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98sitecore · experience platform5 Kas 2021
- CVE-2020-255598Hemen
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97oracle · access manager15 Oca 2020
- CVE-2023-3820398Hemen
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97adobe · coldfusion20 Tem 2023
- CVE-2015-485298Hemen
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96oracle · virtual desktop infrastructure18 Kas 2015
- CVE-2019-1006898Hemen
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95kentico · xperience26 Mar 2019
- CVE-2025-2401697Hemen
Remote code execution in Wazuh server
KritikCVSS 9,9KEVSilahlaştırılmışEPSS %94wazuh · wazuh10 Şub 2025
- CVE-2017-1214996Hemen
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91redhat · jboss enterprise application platform4 Eki 2017
- CVE-2017-306696Hemen
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializa
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91adobe · coldfusion27 Nis 2017
- CVE-2024-4071196Hemen
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90veeam · veeam backup \& replication7 Eyl 2024
- CVE-2026-6307796Hemen
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90jetbrains · teamcity27 Tem 2026