Weaknesses of type CWE-184

202 results

Lista incompleta de entradas bloqueadas

Ocorre quando um aplicativo tenta bloquear entradas maliciosas usando uma lista de padrões ou valores proibidos, mas a lista é incompleta ou pode ser contornada. Um atacante descobre variações não contempladas (encoding diferente, casos alternativos, caracteres especiais) e consegue passar por uma validação que se supõe segura.

Example

Um formulário bloqueia SQL injection filtrando a palavra 'DROP', mas não 'dr0p', não '/*DROP*/' ou variações com espaços. Um atacante usa uma dessas formas para executar comandos SQL maliciosos que a lista de bloqueio não previu.

How to mitigate

Em vez de listar o que é proibido (blocklist), defina explicitamente o que é permitido (allowlist/whitelist) com validação rígida de formato. Use bibliotecas consolidadas de sanitização e escape específicas para cada contexto (SQL, HTML, JavaScript) — nunca confie em listas de palavras-chave.

CVE-2026-65083CRITICALNVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disEPSS 0.9%CVE-2024-51745LOWWasmtime doesn't fully sandbox all the Windows device filenamesEPSS 0.8%CVE-2026-53836HIGHOpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command AliasesEPSS 0.8%CVE-2025-29822HIGHMicrosoft OneNote Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-34430HIGHByteDance DeerFlow LocalSandboxProvider Host Bash EscapeEPSS 0.8%CVE-2020-3384HIGHCisco Data Center Network Manager Command Injection VulnerabilityEPSS 0.8%CVE-2025-71323CRITICALpicklescan - Remote Code Execution via Unblocked ctypes ModuleEPSS 0.8%CVE-2026-17630HIGHLangflow is affected by security vulnerabilities in Model Context Protocol featuresEPSS 0.8%CVE-2022-23536MEDIUMAlertmanager can expose local files content via specially crafted configEPSS 0.8%CVE-2026-48557HIGHSpatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.phpEPSS 0.8%CVE-2026-79696CRITICALRemote Code Execution in Google ADK for Python via Incomplete Standard Library DenylistEPSS 0.7%CVE-2026-69624MEDIUMActive Directory Certificate Services (AD CS) Tampering VulnerabilityEPSS 0.7%CVE-2026-42435HIGHOpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment InjectionEPSS 0.7%CVE-2026-43566CRITICALOpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake EventsEPSS 0.7%CVE-2026-57138CRITICALPraisonAI codeMode sandbox escape via Function constructorEPSS 0.7%CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.7%CVE-2025-71351HIGHpicklescan - Remote Code Execution via timeit.timeit() Detection BypassEPSS 0.7%CVE-2023-3374CRITICALPrivilege Escalation in BookreenEPSS 0.7%CVE-2026-74886CRITICALopenssl_encrypt before 1.4.0 Plugin Import Guard BypassEPSS 0.7%CVE-2026-53873CRITICALpicklescan - Arbitrary Code Execution via profile.run() Blocklist BypassEPSS 0.7%