Weaknesses of type CWE-436

159 results

Conflito de Interpretação

Fraqueza em que diferentes componentes de um sistema interpretam a mesma entrada ou dado de forma diferente, causando inconsistência lógica. Um atacante explora essa divergência para contornar validações em um componente enquanto consegue efeito diferente em outro, comprometendo a segurança geral.

Example

Um firewall valida uma URL como segura interpretando-a de uma forma, mas o navegador a interpreta diferentemente e acessa um endpoint malicioso. Ou um validador servidor rejeita um caminho com '..' enquanto outro componente o normaliza de forma distinta, permitindo path traversal.

How to mitigate

Padronize a interpretação: use bibliotecas de parsing e normalização comuns entre todos os componentes, valide em múltiplas camadas com a mesma lógica, e teste casos de borda onde diferentes interpretadores possam divergir (encoding, caracteres especiais, formatos ambíguos).

CVE-2023-49284LOWCommand substitution output can trigger shell expansion in fish shellEPSS 0.5%CVE-2026-44974HIGHParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parametersEPSS 0.5%CVE-2026-82537HIGHRoo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary MismatchEPSS 0.5%CVE-2026-49473HIGH@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulationEPSS 0.5%CVE-2022-48230HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS.EPSS 0.5%CVE-2022-48261HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause theEPSS 0.5%CVE-2026-84747HIGHApache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path SegmentsEPSS 0.5%CVE-2026-88004HIGHTraefik entrypoint header-name sanitization bypassed via request trailersEPSS 0.5%CVE-2026-0958HIGHInterpretation Conflict in GitLabEPSS 0.4%CVE-2026-63435MEDIUMMail: Email address spoofing via malformed RFC 2047 encoded-wordsEPSS 0.4%CVE-2026-118516MEDIUMSymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access ControlEPSS 0.4%CVE-2026-93750HIGHhttp-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary WildcardEPSS 0.4%CVE-2022-48471HIGHThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer sEPSS 0.4%CVE-2024-29034MEDIUMCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedEPSS 0.4%CVE-2025-66490MEDIUMTraefik doesn't Prevent Path Normalization Bypass in Router + Middleware RulesEPSS 0.4%CVE-2026-16221HIGHfast-uri vulnerable to host confusion via literal backslash authority delimiterEPSS 0.4%CVE-2024-3386MEDIUMPAN-OS: Predefined Decryption Exclusions Does Not Work as IntendedEPSS 0.4%CVE-2026-33807CRITICAL@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopesEPSS 0.4%CVE-2024-24753MEDIUMBref Multiple Value Headers Not Supported in ApiGatewayFormatV2EPSS 0.4%CVE-2026-110682HIGHCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parseEPSS 0.4%