Weaknesses of type CWE-428

358 results

Caminho de busca ou elemento sem aspas

Ocorre quando o código procura executar um programa ou carregar uma biblioteca sem envolver o caminho em aspas, permitindo que espaços ou caracteres especiais no caminho sejam interpretados como separadores. Um atacante pode criar um executável em um diretório intermediário (ex: C:\Program Files\) e fazer com que o programa execute seu arquivo malicioso em vez do legítimo.

Example

Uma aplicação tenta chamar C:\Program Files\MyApp\tool.exe sem aspas. Se o Windows procura em C:\Program.exe primeiro (por causa do espaço), um atacante pode colocar um programa malicioso em C:\ com esse nome e ganhar execução de código.

How to mitigate

Sempre envolva caminhos completos em aspas duplas ("C:\\Program Files\\MyApp\\tool.exe") ou use APIs que aceitam argumentos separados (sem passar por shell parsing). Valide e normalize caminhos antes de usá-los.

CVE-2025-57714HIGHNetBak ReplicatorEPSS 0.2%CVE-2020-36977HIGHWondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service PathEPSS 0.2%CVE-2019-19705HIGHRealtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG bEPSS 0.2%CVE-2023-0392LOWThe LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.EPSS 0.2%CVE-2022-50938HIGHCONTPAQi® AdminPAQ 14.0.0 - Unquoted Service PathEPSS 0.2%CVE-2023-2644MEDIUMDigitalPersona FPSensor DpHost.exe unquoted search pathEPSS 0.2%CVE-2023-5012MEDIUMTopaz OFD Protection Module Warsaw core.exe unquoted search pathEPSS 0.2%CVE-2024-6080HIGHIntelbras InControl incontrolWebcam Service unquoted search pathEPSS 0.2%CVE-2022-50933HIGHCain & Abel 4.9.56 - Unquoted Service PathEPSS 0.2%CVE-2022-50918HIGHVIVE Runtime Service - 'ViveAgentService' Unquoted Service PathEPSS 0.2%CVE-2024-34010HIGHLocal privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud AgentEPSS 0.2%CVE-2022-50693HIGHSplashtop 8.71.12001.0 - Unquoted Service PathEPSS 0.2%CVE-2022-50929HIGHConnectify Hotspot 2018 'ConnectifyService' - Unquoted Service PathEPSS 0.2%CVE-2025-61865HIGHMultiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the wEPSS 0.2%CVE-2023-22282HIGHWAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces aEPSS 0.2%CVE-2026-25865HIGHPunto Switcher 4.5.0.583 Unquoted Search Path via WinExecEPSS 0.2%CVE-2026-66839HIGHNetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An auEPSS 0.2%CVE-2023-29165MEDIUMUnquoted search path or element in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to poteEPSS 0.2%CVE-2023-32658MEDIUMUnquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may aEPSS 0.2%CVE-2025-21107HIGHDell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerabEPSS 0.2%