Weaknesses of type CWE-428

358 results

Caminho de busca ou elemento sem aspas

Ocorre quando o código procura executar um programa ou carregar uma biblioteca sem envolver o caminho em aspas, permitindo que espaços ou caracteres especiais no caminho sejam interpretados como separadores. Um atacante pode criar um executável em um diretório intermediário (ex: C:\Program Files\) e fazer com que o programa execute seu arquivo malicioso em vez do legítimo.

Example

Uma aplicação tenta chamar C:\Program Files\MyApp\tool.exe sem aspas. Se o Windows procura em C:\Program.exe primeiro (por causa do espaço), um atacante pode colocar um programa malicioso em C:\ com esse nome e ganhar execução de código.

How to mitigate

Sempre envolva caminhos completos em aspas duplas ("C:\\Program Files\\MyApp\\tool.exe") ou use APIs que aceitam argumentos separados (sem passar por shell parsing). Valide e normalize caminhos antes de usá-los.

CVE-2021-47822HIGHDiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service PathEPSS 0.2%CVE-2020-37047HIGHDeep Instinct Windows Agent 1.2.29.0 - 'DeepMgmtService' Unquoted Service PathEPSS 0.2%CVE-2021-47845HIGHSpy Emergency 25.0.650 - Unquoted Service PathEPSS 0.2%CVE-2021-47829HIGHDHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service PathEPSS 0.2%CVE-2019-25275HIGHBartVPN 1.2.2 - 'BartVPNService' Unquoted Service PathEPSS 0.2%CVE-2019-25272HIGHTexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service PathEPSS 0.2%CVE-2020-37055HIGHSpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service PathEPSS 0.2%CVE-2020-37037HIGHAVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service PathEPSS 0.2%CVE-2024-2747HIGHCWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user reEPSS 0.2%CVE-2019-25273HIGHEasy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service PathEPSS 0.2%CVE-2021-47833HIGHWifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service PathEPSS 0.2%CVE-2020-37062HIGHDHCP Turbo 4.6.1298- 'DHCP Turbo 4' Unquoted Service PathEPSS 0.2%CVE-2024-5963MEDIUMAn unquoted executable path exists in Hitachi Device ManagerEPSS 0.2%CVE-2016-20091HIGHWindows Firewall Control 4.8.6.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2021-47985HIGHBrother SAPSprint 7.60 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2021-47882HIGHFreeLAN 2.2 - 'FreeLAN Service' Unquoted Service PathEPSS 0.2%CVE-2024-31201MEDIUMA “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenariosEPSS 0.2%CVE-2026-24466HIGHProducts provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows serviceEPSS 0.2%CVE-2026-77827HIGHMaono Link local privilege escalationEPSS 0.2%CVE-2021-47828HIGHBOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service PathEPSS 0.2%