Weaknesses of type CWE-706

122 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2022-30258CRITICALAn issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domainEPSS 0.7%CVE-2024-57785MEDIUMZenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.EPSS 0.7%CVE-2024-27295HIGHDirectus MySQL accent insensitive email matchingEPSS 0.7%CVE-2024-52515MEDIUMNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsEPSS 0.7%CVE-2021-37215MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4EPSS 0.7%CVE-2023-42451HIGHMastodon Invalid Domain Name Normalization vulnerabilityEPSS 0.7%CVE-2021-37212MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1EPSS 0.6%CVE-2026-67602CRITICALphpIPAM < 1.8.2 Authentication Bypass via REST API Object CacheEPSS 0.6%CVE-2025-58362HIGHHono contains a flaw in URL path parsing, potentially leading to path confusionEPSS 0.6%CVE-2026-62685HIGHFile Browser: Colliding username normalization gives two users the same home directoryEPSS 0.6%CVE-2023-28628MEDIUM`authority-regex` returns the wrong authority in lambdaisland/uriEPSS 0.5%CVE-2026-107822MEDIUMMariaDB: database privilege escalation via user / role name collision in the acl cacheEPSS 0.5%CVE-2026-62190HIGHOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperEPSS 0.5%CVE-2026-78985CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeringEPSS 0.5%CVE-2026-87547CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeringEPSS 0.5%CVE-2026-25890HIGHFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLEPSS 0.5%CVE-2026-13372HIGHIncorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.EPSS 0.5%CVE-2026-118938HIGHFickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysisEPSS 0.5%CVE-2026-87613CRITICALIncorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrEPSS 0.5%CVE-2026-92951CRITICALvm2 before 3.11.7 Module Allowlist Bypass via Custom ResolverEPSS 0.5%