Weaknesses of type CWE-706

88 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2026-79070MEDIUMIncorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a EPSS 0.3%CVE-2026-30856MEDIUMWeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionEPSS 0.3%CVE-2026-33732MEDIUMsrvx is vulnerable to middleware bypass via absolute URI in request lineEPSS 0.2%CVE-2026-35635MEDIUMOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology ChatEPSS 0.2%CVE-2024-45305LOWgix-path uses local config across repos when it is the highest scopeEPSS 0.2%CVE-2026-79254MEDIUMIncorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass systeEPSS 0.2%CVE-2026-33490LOWh3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching RoutesEPSS 0.2%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-45306MEDIUMpyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryEPSS 0.2%CVE-2024-55058MEDIUMAn insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerabiliEPSS 0.2%CVE-2026-79103LOWIncorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer EPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2026-1230MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-88621LOWOneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticatedEPSS 0.2%CVE-2026-54282LOWStarlette: Unvalidated request path concatenated into authority poisons request.url.hostnameEPSS 0.2%CVE-2026-8716MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-87562MEDIUMIncorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially sEPSS 0.2%CVE-2026-35358MEDIUMuutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream ReadingEPSS 0.2%CVE-2025-62378MEDIUMCommandKit exposes incorrect command name in context object for message command aliasesEPSS 0.2%CVE-2026-42254MEDIUMHickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query thatEPSS 0.2%