Weaknesses of type CWE-706

88 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2026-35666HIGHOpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch WrapperEPSS 0.4%CVE-2026-92951CRITICALvm2 before 3.11.7 Module Allowlist Bypass via Custom ResolverEPSS 0.4%CVE-2026-57054MEDIUMJunos OS: MX Series: Web filtering doesn't block specifically formatted URLsEPSS 0.4%CVE-2026-3125HIGHSSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypassEPSS 0.4%CVE-2026-79049MEDIUMIncorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restriEPSS 0.4%CVE-2026-67602CRITICALphpIPAM < 1.8.2 Authentication Bypass via REST API Object CacheEPSS 0.4%CVE-2026-87613CRITICALIncorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrEPSS 0.4%CVE-2026-54022MEDIUMOpen WebUI: Any authenticated user can read other users' private notes via Socket.IOEPSS 0.3%CVE-2025-12506LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-87618HIGHIncorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-78942MEDIUMIncorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via cEPSS 0.3%CVE-2025-29914MEDIUMOWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`EPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%CVE-2026-41354MEDIUMOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe KeysEPSS 0.3%CVE-2022-28198MEDIUMNVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the syEPSS 0.3%CVE-2026-13097HIGHIpa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastoreEPSS 0.3%CVE-2026-10696HIGHUse of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet communiEPSS 0.3%CVE-2026-41402LOWOpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope BypassEPSS 0.3%CVE-2026-29036HIGHcJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape DecodingEPSS 0.3%CVE-2026-79273MEDIUMIncorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypEPSS 0.3%