Weaknesses of type CWE-706

88 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2021-37215MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4EPSS 0.7%CVE-2023-42451HIGHMastodon Invalid Domain Name Normalization vulnerabilityEPSS 0.7%CVE-2024-52515MEDIUMNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsEPSS 0.7%CVE-2021-37212MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1EPSS 0.6%CVE-2026-78985CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeringEPSS 0.6%CVE-2026-62685HIGHFile Browser: Colliding username normalization gives two users the same home directoryEPSS 0.6%CVE-2023-28628MEDIUM`authority-regex` returns the wrong authority in lambdaisland/uriEPSS 0.5%CVE-2025-58362HIGHHono contains a flaw in URL path parsing, potentially leading to path confusionEPSS 0.5%CVE-2026-65816CRITICALAzure Arc Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-62190HIGHOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperEPSS 0.5%CVE-2026-13372HIGHIncorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.EPSS 0.5%CVE-2026-76039MEDIUMIncorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social enEPSS 0.5%CVE-2026-25890HIGHFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLEPSS 0.5%CVE-2025-30357HIGHNamelessMC Forum Topic Deletion Triggered by Unrelated User DeletionEPSS 0.5%CVE-2022-41874LOWTauri Filesystem Scope can be Partially BypassedEPSS 0.4%CVE-2023-27561HIGHrunc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit thiEPSS 0.4%CVE-2026-87547CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeringEPSS 0.4%CVE-2026-16120MEDIUMnextlevelbuilder GoClaw exec_approval.go extractBin name resolutionEPSS 0.4%CVE-2023-42125HIGHAvast Premium Security Sandbox Protection Link Following Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-79264MEDIUMIncorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via EPSS 0.4%