Weaknesses of type CWE-691

33 results

Controle de fluxo insuficiente

Ocorre quando o software não gerencia adequadamente o fluxo de execução, permitindo que código não planejado seja executado ou que verificações de segurança sejam contornadas. A falta de controle explícito sobre qual código roda e em que ordem cria brechas para escalação de privilégio ou execução de operações não autorizadas.

Example

Uma aplicação valida permissões ao início de uma função, mas não reinicia a validação dentro de callbacks ou threads assíncronos. Um usuário sem privilégio consegue explorar a execução descontrolada para acessar recursos administrativos.

How to mitigate

Implemente verificações de autorização em pontos-chave do fluxo (especialmente antes de operações sensíveis), use máquinas de estado para controlar transições legítimas e evite desvios implícitos. Testes de penetração focados em fluxo alternativo ajudam a identificar caminhos não previstos.

CVE-2022-20697HIGHCisco IOS and IOS XE Software Web Services Denial of Service VulnerabilityEPSS 1.1%CVE-2024-3847CRITICALInsufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policyEPSS 0.8%CVE-2023-20559HIGH Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leadEPSS 0.7%CVE-2023-5102MEDIUM Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionalitEPSS 0.6%CVE-2024-33617HIGHInsufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosureEPSS 0.4%CVE-2024-37158LOWEvmos is missing precompile checksEPSS 0.4%CVE-2023-44384MEDIUMDiscourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationEPSS 0.4%CVE-2025-47774LOWVyper's `slice()` may elide side-effects when output length is 0EPSS 0.4%CVE-2025-49463MEDIUMZoom Clients for iOS - Insufficient Control Flow ManagementEPSS 0.4%CVE-2025-25774MEDIUMAn issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may causeEPSS 0.4%CVE-2025-47285LOWVyper's `concat()` builtin may elide side-effects for zero-length argumentsEPSS 0.4%CVE-2022-46828MEDIUMIn JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.EPSS 0.3%CVE-2021-4106HIGHVulnerability in Snow Inventory Java ScannerEPSS 0.3%CVE-2026-20271HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.3%CVE-2022-46299LOWInsufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enable information discloEPSS 0.2%CVE-2022-48481MEDIUMIn JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possibleEPSS 0.2%CVE-2025-20022MEDIUMInsufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a privileged user to poEPSS 0.2%CVE-2024-29079MEDIUMInsufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentiallyEPSS 0.2%CVE-2021-33157HIGHInsufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allEPSS 0.2%CVE-2025-35963HIGHInsufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: DeviceEPSS 0.2%