Weaknesses of type CWE-706

122 results

Resolução incorreta de nome ou referência

O código tenta acessar um recurso (variável, função, arquivo, classe) pelo nome, mas resolve para um objeto diferente do esperado. Isso ocorre por ambiguidade no escopo, namespaces conflitantes, shadowing de variáveis ou ordem de resolução inadequada. Um atacante pode explorar isso para injetar código malicioso, acessar dados sensíveis ou desviar o fluxo de execução.

Example

Um programa importa duas bibliotecas que definem uma função com o mesmo nome (ex: `processData()`). Se a resolução não é explícita, o código pode chamar a função errada e executar lógica não-intencional. Outro cenário: uma variável local `usuario` é criada após a verificação, mascarando a variável global de segurança.

How to mitigate

Use namespaces explícitos, qualificadores completos (ex: `modulo.funcao()`) e evite shadowing de variáveis. Configure linters e analisadores estáticos para detectar ambiguidades. Em linguagens como Python ou C++, seja explícito com imports e use type hints para melhorar rastreabilidade.

CVE-2026-119270HIGHIncorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2026-1230MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-119265HIGHIncorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2026-79254MEDIUMIncorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass systeEPSS 0.2%CVE-2026-77605HIGHNotepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)EPSS 0.2%CVE-2026-8716MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-35358MEDIUMuutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream ReadingEPSS 0.2%CVE-2026-114663HIGHVyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default ArgumentsEPSS 0.2%CVE-2026-119675MEDIUMmongorestore may bypass collection guards through a system.buckets prefixEPSS 0.2%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-118314HIGHIncorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineEPSS 0.2%CVE-2025-62378MEDIUMCommandKit exposes incorrect command name in context object for message command aliasesEPSS 0.2%CVE-2026-78359MEDIUMDuplicate Identity / Identity Shadowing across CustomerUser backendsEPSS 0.2%CVE-2026-42254MEDIUMHickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query thatEPSS 0.2%CVE-2026-41131MEDIUMOpenFGA has Improper Policy EnforcementEPSS 0.1%CVE-2024-51746LOWUse of incorrect Rekor entries during verification in gitsignEPSS 0.1%CVE-2026-91727HIGHIncorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised EPSS 0.1%CVE-2026-93375HIGHIncorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execEPSS 0.1%