Weaknesses of type CWE-706

122 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2026-78942MEDIUMIncorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via cEPSS 0.3%CVE-2026-41354MEDIUMOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe KeysEPSS 0.3%CVE-2022-28198MEDIUMNVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the syEPSS 0.3%CVE-2026-95275MEDIUMIncorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy EPSS 0.3%CVE-2026-54282LOWStarlette: Unvalidated request path concatenated into authority poisons request.url.hostnameEPSS 0.3%CVE-2026-10696HIGHUse of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet communiEPSS 0.3%CVE-2026-106409HIGHIncorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromEPSS 0.3%CVE-2026-41402LOWOpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope BypassEPSS 0.3%CVE-2026-119266HIGHIncorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2026-14288LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-33732MEDIUMsrvx is vulnerable to middleware bypass via absolute URI in request lineEPSS 0.3%CVE-2026-35635MEDIUMOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology ChatEPSS 0.3%CVE-2026-118309CRITICALIncorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social enginEPSS 0.3%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-33490LOWh3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching RoutesEPSS 0.2%CVE-2024-45305LOWgix-path uses local config across repos when it is the highest scopeEPSS 0.2%CVE-2024-55058MEDIUMAn insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerabiliEPSS 0.2%CVE-2026-87562MEDIUMIncorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially sEPSS 0.2%CVE-2026-45306MEDIUMpyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryEPSS 0.2%CVE-2026-106325MEDIUMIncorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leEPSS 0.2%