Weaknesses of type CWE-15

80 results

Controle Externo de Configurações do Sistema

A aplicação permite que um atacante modifique configurações críticas do sistema ou da aplicação através de entrada externa (parâmetros, arquivos, variáveis de ambiente, etc.), sem validação adequada. Isso pode levar ao comprometimento da segurança, funcionamento incorreto ou acesso não autorizado.

Example

Um serviço web aceita um parâmetro 'debug_mode' vindo da requisição HTTP e o usa diretamente para ligar/desligar logs sensíveis ou alternar validações de segurança. Um atacante manda debug_mode=true e expõe dados internos ou desativa proteções.

How to mitigate

Nunca confie em entradas externas para configurações sensíveis. Use apenas fontes confiáveis (arquivo de config protegido no servidor, variáveis de ambiente do deployment) e valide/sanitize rigorosamente qualquer entrada que possa impactar comportamento de segurança.

CVE-2021-31338—A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuratioEPSS 0.2%CVE-2025-62527HIGHTaguette vulnerable to password reset link poisoningEPSS 0.2%CVE-2025-27253MEDIUMA CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attEPSS 0.2%CVE-2026-22750HIGHSSL bundle configuration silently bypassed in Spring Cloud GatewayEPSS 0.2%CVE-2026-43531HIGHOpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env FileEPSS 0.2%CVE-2023-6154HIGHLocal privilege escalation in Bitdefender Total Security (VA-11168)EPSS 0.2%CVE-2026-1784HIGHOse-cluster-ingress-operator: remote code execution through haproxy configuration injectionEPSS 0.2%CVE-2026-33092HIGHLocal privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (mEPSS 0.2%CVE-2026-0495MEDIUMMultiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)EPSS 0.2%CVE-2025-0425HIGHLocal Privilege Escalation via Config ManipulationEPSS 0.2%CVE-2025-64726HIGHExternal Control of System or Configuration Setting and Uncontrolled Search Path Element in sfwEPSS 0.1%CVE-2026-0232MEDIUMCortex XDR Agent: Local Administrator can disable the agent on WindowsEPSS 0.1%CVE-2026-41384HIGHOpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI BackendEPSS 0.1%CVE-2026-85217HIGHMan-in-the-Middle (MITM) Vulnerability in Autodesk Fusion DesktopEPSS 0.1%CVE-2026-41489HIGHPi-hole: Local privilege escalation via config-controlled path in root-executed service hooksEPSS 0.1%CVE-2026-19884HIGHIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trustEPSS 0.1%CVE-2026-41294HIGHOpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env FileEPSS 0.1%CVE-2026-21422LOWDell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. A EPSS 0.1%CVE-2026-19592HIGHOpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata withoEPSS 0.1%CVE-2026-56567MEDIUMHCL iControl is affected by multiple security vulnerabilities.EPSS 0.1%