Weaknesses of type CWE-183

44 results

Lista Permissiva de Entradas Permitidas

Ocorre quando uma aplicação define uma lista de entradas 'seguras' ou permitidas que é demasiado aberta, deixando passar dados malformados ou maliciosos que não deveriam ser aceitos. O risco está em validar por uma whitelist fraca, assumindo que tudo dentro dela é inofensivo quando na verdade comportamentos perigosos conseguem passar.

Example

Uma API permite apenas domínios de email em uma whitelist (ex: 'example.com', 'empresa.com'), mas a regex usada é mal configurada e aceita também 'example.com.atacante.com' ou '.example.com'; um usuário autenticado indevidamente consegue registrar-se ou fazer bypass de verificações.

How to mitigate

Use validação por blacklist combinada com whitelist restrita, ou melhor ainda: valide por padrão rigoroso (regex exato ou parsing estruturado). Teste a whitelist com casos extremos e variações (subdomínios, caracteres especiais, null bytes) antes de deploy. Revise periodicamente o escopo da lista permitida.

CVE-2020-25696—A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6EPSS 2.6%CVE-2026-21915HIGHJSI Virtual Lightweight Collector: Shell escape allows privilege escalation to rootEPSS 2.2%CVE-2020-1694—A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw reEPSS 1.6%CVE-2024-1654HIGHUnauthorized write operations in PaperCut NG/MFEPSS 1.3%CVE-2023-4399MEDIUMGrafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows adEPSS 1.1%CVE-2021-34787MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass VulnerabilityEPSS 1.0%CVE-2021-40128MEDIUMCisco Webex Meetings Email Content Injection VulnerabilityEPSS 1.0%CVE-2023-7250MEDIUMIperf3: possible denial of serviceEPSS 0.9%CVE-2026-29514HIGHNetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixinEPSS 0.8%CVE-2025-59457HIGHIn JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on WindowsEPSS 0.8%CVE-2025-53762HIGHMicrosoft Purview Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-23158MEDIUMWyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard priviEPSS 0.7%CVE-2026-42043HIGHAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0EPSS 0.7%CVE-2026-3490CRITICALpicklescan - Universal Blocklist Bypass via pkgutil.resolve_nameEPSS 0.6%CVE-2025-24349HIGHA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) aEPSS 0.6%CVE-2026-46391HIGHHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisEPSS 0.5%CVE-2022-42469MEDIUMA permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW EPSS 0.4%CVE-2022-34450MEDIUM PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially EPSS 0.4%CVE-2026-54316MEDIUMClaude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchEPSS 0.4%CVE-2026-40899HIGHDataEase has an Arbitrary File Read VulnerabilityEPSS 0.4%