Fallos del tipo CWE-184

197 resultados

Lista incompleta de entradas bloqueadas

Ocorre quando o desenvolvedor cria uma lista de padrões ou caracteres proibidos, mas deixa de fora alguns que também deveriam estar ali. Atacantes exploram as entradas não bloqueadas para contornar a validação e injetar código malicioso ou dados malformados.

Ejemplo

Um formulário bloqueia caracteres como '<' e '>' para prevenir XSS, mas esquece de bloquear aspas duplas e eventos JavaScript embutidos. Um atacante injeta onclick="alert('pwned')" e a validação deixa passar.

Cómo mitigar

Use abordagem whitelist (aceitar só o que é válido) em vez de blacklist (bloquear o que é ruim). Se precisar de blacklist, revise frequentemente a lista e teste contra vetores conhecidos. Melhor ainda: sanitize a entrada conforme o contexto onde será usada (HTML, SQL, URL, etc).

CVE-2026-42427MEDIUMOpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable InjectionEPSS 0.2%CVE-2026-41206MEDIUMPySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_codeEPSS 0.2%CVE-2026-53848LOWOpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command WrappersEPSS 0.2%CVE-2025-69277MEDIUMlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_poinEPSS 0.2%CVE-2026-43991HIGHJunoClaw: plugin-shell shell-injection bypass via substring blocklistEPSS 0.2%CVE-2026-33139HIGHPySpector: Plugin Sandbox Bypass leads to Arbitrary Code ExecutionEPSS 0.2%CVE-2026-56547LOWAn input reflection vulnerability affects HCL TravelerEPSS 0.2%CVE-2026-45037HIGHTabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocationEPSS 0.1%CVE-2026-85788MEDIUMIncomplete list of disallowed inputs in awslabs mysql-mcp-serverEPSS 0.1%CVE-2026-44114HIGHOpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenvEPSS 0.1%CVE-2026-41391MEDIUMOpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL HandlingEPSS 0.1%CVE-2026-33197HIGHBDS Module Bypass Secure Boot AdvisoryEPSS 0.1%CVE-2026-71259HIGHESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code ExecutionEPSS 0.1%CVE-2026-41392MEDIUMOpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File OptionsEPSS 0.1%CVE-2026-41915MEDIUMOpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec EnvironmentEPSS 0.1%CVE-2026-41332MEDIUMOpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable BlocklistEPSS 0.1%CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS —