Weaknesses of type CWE-428

358 results

Caminho de busca ou elemento sem aspas

Ocorre quando o código procura executar um programa ou carregar uma biblioteca sem envolver o caminho em aspas, permitindo que espaços ou caracteres especiais no caminho sejam interpretados como separadores. Um atacante pode criar um executável em um diretório intermediário (ex: C:\Program Files\) e fazer com que o programa execute seu arquivo malicioso em vez do legítimo.

Example

Uma aplicação tenta chamar C:\Program Files\MyApp\tool.exe sem aspas. Se o Windows procura em C:\Program.exe primeiro (por causa do espaço), um atacante pode colocar um programa malicioso em C:\ com esse nome e ganhar execução de código.

How to mitigate

Sempre envolva caminhos completos em aspas duplas ("C:\\Program Files\\MyApp\\tool.exe") ou use APIs que aceitam argumentos separados (sem passar por shell parsing). Valide e normalize caminhos antes de usá-los.

CVE-2020-37059HIGHPopcorn Time 6.2 - 'Update service' Unquoted Service PathEPSS 0.2%CVE-2022-50930HIGHEmerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service PathEPSS 0.2%CVE-2025-41359HIGHMultiple vulnerabilities in Small HTTP server by SmallsrvEPSS 0.2%CVE-2025-0884HIGHPrivilege Escalation vulnerability has been discovered in OpenText™ Service Manager.EPSS 0.2%CVE-2022-50920HIGHSandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service PathEPSS 0.2%CVE-2023-53946HIGHArcsoft PhotoStudio 6.0.0.172 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2022-50913HIGHTCQ - 'ITeCProteccioAppServer.exe' Unquoted Service PathEPSS 0.2%CVE-2016-20056HIGHSpy Emergency build 23.0.205 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2023-53947HIGHOCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2020-37253HIGHWinstep 18.06.0096 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2022-50904HIGHWondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service PathEPSS 0.2%CVE-2025-66271HIGHClone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on thEPSS 0.2%CVE-2019-25231HIGHdevolo dLAN Cockpit 4.3.1 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2025-66461HIGHFULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arEPSS 0.2%CVE-2025-9043MEDIUMThe service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploitEPSS 0.2%CVE-2016-20060HIGHHotspot Shield 6.0.3 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2026-57223HIGHSuricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalationEPSS 0.2%CVE-2021-47869HIGHBRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service PathEPSS 0.2%CVE-2019-25293HIGHBlue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service PathEPSS 0.2%CVE-2019-25304HIGHIntelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service PathEPSS 0.2%