Fallos del tipo CWE-1289

40 resultados

Validação inadequada de equivalência perigosa em entrada

A aplicação valida entrada comparando valores de forma insegura, aceitando representações diferentes que deveriam ser tratadas como equivalentes perigosas. Por exemplo, aceitar '/path/../file' e '/path/file' como diferentes durante validação, quando a segunda é a forma canonicalizada que o sistema realmente acessa, permitindo contorno de filtros de segurança.

Ejemplo

Um WAF bloqueia requisições para '/admin/config' mas permite '/admin//config' (barra dupla) ou '/admin/./config' (ponto de diretório). O validador não normaliza o caminho antes de comparar contra a blacklist, então o navegador/servidor interpreta '//config' como 'config', contornando a proteção.

Cómo mitigar

Normalizar e canonicalizar toda entrada antes de validar (remover './', '../', barras duplicadas, decodificar URL/entidades). Comparar a forma canônica contra regras de segurança, nunca a entrada bruta. Considerar usar bibliotecas de segurança consolidadas que já fazem isso corretamente.

CVE-2026-33810HIGHCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509EPSS 0.3%CVE-2026-27610HIGHParse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only SessionsEPSS 0.3%CVE-2026-45190MEDIUMNet::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypassEPSS 0.3%CVE-2026-49942HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate network masksEPSS 0.3%CVE-2026-45191MEDIUMNet::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypassEPSS 0.3%CVE-2024-42219HIGH1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is EPSS 0.3%CVE-2026-41213MEDIUM@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codesEPSS 0.3%CVE-2026-41239MEDIUMDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeEPSS 0.2%CVE-2026-50090CRITICALAqara OAuth redirect_uri validation bypassEPSS 0.2%CVE-2026-47674MEDIUMHono: IP Restriction bypasses static deny rules for non-canonical IPv6EPSS 0.2%CVE-2026-33729MEDIUMOpenFGA has an Authorization Bypass through cached keysEPSS 0.2%CVE-2026-76977MEDIUMClickjacking vulnerability in SAPUI5(Frame Options Allowlist)EPSS 0.2%CVE-2024-12224MEDIUMidna accepts Punycode labels that do not produce any non-ASCII when decodedEPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2024-42218MEDIUM1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.EPSS 0.2%CVE-2026-49940MEDIUMNet::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasksEPSS 0.2%CVE-2026-22569MEDIUMIncorrect startup configuration in ZCCEPSS 0.2%CVE-2026-34080MEDIUMxdg-dbus-proxy has an eavesdrop filter bypass allowing message interceptionEPSS 0.2%CVE-2026-42462HIGHFedify has an LD-Signature Bypass via JSON-LD Named-Graph RestructuringEPSS 0.2%CVE-2026-1094MEDIUMImproper Validation of Unsafe Equivalence in Input in GitLabEPSS 0.2%