Weaknesses of type CWE-706

122 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2026-79070MEDIUMIncorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a EPSS 0.3%CVE-2026-79273MEDIUMIncorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypEPSS 0.3%CVE-2026-79264MEDIUMIncorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via EPSS 0.3%CVE-2025-12506LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-76039MEDIUMIncorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social enEPSS 0.3%CVE-2026-61844HIGHFileRise: Folder Metadata Filename Collisions Bypass "read_own" IsolationEPSS 0.3%CVE-2026-95334HIGHIncorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rendeEPSS 0.3%CVE-2025-29914MEDIUMOWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`EPSS 0.3%CVE-2026-121133HIGHIncorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-88621LOWOneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticatedEPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%CVE-2026-87720HIGHIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewEPSS 0.3%CVE-2026-106181MEDIUMIncorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-106230MEDIUMIncorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-79103LOWIncorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer EPSS 0.3%CVE-2026-25825LOWAn issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set tEPSS 0.3%CVE-2026-30856MEDIUMWeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionEPSS 0.3%CVE-2026-110156HIGHIncorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromisedEPSS 0.3%CVE-2026-106308HIGHIncorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging socialEPSS 0.3%CVE-2026-106274HIGHIncorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engiEPSS 0.3%