Weaknesses of type CWE-706

122 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2022-41874LOWTauri Filesystem Scope can be Partially BypassedEPSS 0.5%CVE-2026-113034HIGHIncorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendeEPSS 0.5%CVE-2025-30357HIGHNamelessMC Forum Topic Deletion Triggered by Unrelated User DeletionEPSS 0.5%CVE-2023-27561HIGHrunc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit thiEPSS 0.4%CVE-2026-29036HIGHcJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape DecodingEPSS 0.4%CVE-2026-87618HIGHIncorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromiseEPSS 0.4%CVE-2026-113223MEDIUMIncorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering tEPSS 0.4%CVE-2026-113159MEDIUMIncorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering tEPSS 0.4%CVE-2023-42125HIGHAvast Premium Security Sandbox Protection Link Following Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-3125HIGHSSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypassEPSS 0.4%CVE-2026-16120MEDIUMnextlevelbuilder GoClaw exec_approval.go extractBin name resolutionEPSS 0.4%CVE-2026-35666HIGHOpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch WrapperEPSS 0.4%CVE-2026-79049MEDIUMIncorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restriEPSS 0.4%CVE-2026-121200CRITICALIncorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering tEPSS 0.4%CVE-2026-57054MEDIUMJunos OS: MX Series: Web filtering doesn't block specifically formatted URLsEPSS 0.4%CVE-2026-113102MEDIUMIncorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeringEPSS 0.4%CVE-2026-85491HIGHCatalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path aloneEPSS 0.4%CVE-2026-89313MEDIUMJwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEPSS 0.3%CVE-2026-54022MEDIUMOpen WebUI: Any authenticated user can read other users' private notes via Socket.IOEPSS 0.3%CVE-2026-95106CRITICALGitea review and execution mismatch through duplicate tree entriesEPSS 0.3%