Weaknesses of type CWE-477

16 results

Uso de função obsoleta ou descontinuada

Ocorre quando o código chama funções que foram marcadas como obsoletas, descontinuadas ou removidas pela linguagem, framework ou biblioteca. Essas funções geralmente têm comportamento imprevisível, vulnerabilidades conhecidas ou podem desaparecer sem aviso, deixando o sistema instável ou exposto.

Example

Um aplicativo legado em C usa strcpy() para copiar strings, ignorando o aviso do compilador de que a função é insegura. Um atacante fornece uma string maior que o buffer esperado, causando buffer overflow e execução de código remoto.

How to mitigate

Substitua funções obsoletas por alternativas seguras e mantidas (ex: strcpy() → strncpy() ou strlcpy(); md5() → sha256()). Monitore avisos do compilador e de ferramentas de análise estática, e atualize dependências regularmente para evitar ficar preso a código descontinuado.

CVE-2025-49213CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 9.8%CVE-2025-49212CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 9.8%CVE-2018-17890—NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbEPSS 3.3%CVE-2025-49220CRITICALAn insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execEPSS 2.0%CVE-2019-18251—In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of TeamviewEPSS 1.7%CVE-2025-49219CRITICALAn insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code exeEPSS 1.4%CVE-2025-49217CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 1.1%CVE-2020-6978—In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.EPSS 0.8%CVE-2025-49214HIGHAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code exEPSS 0.8%CVE-2022-1384MEDIUMAuthorized users are allowed to install old plugin versions from the MarketplaceEPSS 0.6%CVE-2023-23451CRITICALThe Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE4EPSS 0.6%CVE-2025-49216CRITICALAn authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as EPSS 0.5%CVE-2019-10988—In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 UltrasEPSS 0.3%CVE-2019-10968—Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabEPSS 0.3%CVE-2026-1693MEDIUMUse of vulnerable Resource Owner Password Credentials flowEPSS 0.3%CVE-2023-28829LOWA vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7EPSS 0.3%