Fallos del tipo CWE-158

28 resultados

Neutralização Inadequada de Caractere Nulo (Null Byte)

Ocorre quando a aplicação não trata corretamente o caractere nulo (\0) em strings, permitindo que um invasor interrompa ou contorne validações. Por exemplo, ao processar caminhos de arquivo ou nomes, um null byte pode fazer o parser ignorar tudo que vem depois, contornando filtros de extensão ou whitelist.

Ejemplo

Um validador aceita upload de .txt mas rejeita .php. Um atacante envia 'shell.php\0.txt' — o parser para no null byte e registra apenas 'shell.php', salvando um script malicioso que passa pela validação.

Cómo mitigar

Validar e rejeitar strings contendo null bytes antes de qualquer processamento crítico (arquivo, SQL, comandos do SO); usar APIs seguras que lidam automaticamente com este caractere; implementar whitelist rigorosa baseada em extensão verdadeira, não em substring.

CVE-2025-47812CRITICALIn Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua codeEPSS 95.3%KEVCVE-2009-1537HIGHUnspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows EPSS 51.2%KEVCVE-2022-20812CRITICALCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 1.8%CVE-2020-14500CRITICALIMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158EPSS 1.7%CVE-2020-7928MEDIUMImproper neutralization of null byte leads to read overrunEPSS 1.4%CVE-2022-20813CRITICALCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 1.1%CVE-2025-9648HIGHDenial of Service in CivetWebEPSS 0.7%CVE-2024-10921MEDIUMImproper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerEPSS 0.5%CVE-2026-23863MEDIUMAn attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents wEPSS 0.5%CVE-2023-5719HIGHRed Lion Crimson Improper Neutralization of Null Byte or NUL CharacterEPSS 0.5%CVE-2024-9026LOWPHP-FPM logs from children may be alteredEPSS 0.5%CVE-2025-1936HIGHAdding %00 and a fake extension to a jar: URL changed the interpretation of the contentsEPSS 0.4%CVE-2025-14388CRITICALPhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte InjectionEPSS 0.4%CVE-2025-66263HIGHUnauthenticated Arbitrary File Read via Null Byte InjectionEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2020-5363HIGHSelect Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's managEPSS 0.3%CVE-2024-0408MEDIUMXorg-x11-server: selinux unlabeled glx pbufferEPSS 0.3%CVE-2025-55113CRITICALBMC Control-M/Agent unescaped NULL byte in access control list checksEPSS 0.3%CVE-2026-4359LOWHeap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated bufferEPSS 0.2%CVE-2022-31223LOWDell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentiallyEPSS 0.2%