Fallos del tipo CWE-184
201 resultadosLista incompleta de entradas bloqueadas
Ocorre quando o desenvolvedor cria uma lista de padrões ou caracteres proibidos, mas deixa de fora alguns que também deveriam estar ali. Atacantes exploram as entradas não bloqueadas para contornar a validação e injetar código malicioso ou dados malformados.
Ejemplo
Um formulário bloqueia caracteres como '<' e '>' para prevenir XSS, mas esquece de bloquear aspas duplas e eventos JavaScript embutidos. Um atacante injeta onclick="alert('pwned')" e a validação deixa passar.
Cómo mitigar
Use abordagem whitelist (aceitar só o que é válido) em vez de blacklist (bloquear o que é ruim). Se precisar de blacklist, revise frequentemente a lista e teste contra vetores conhecidos. Melhor ainda: sanitize a entrada conforme o contexto onde será usada (HTML, SQL, URL, etc).
CVE-2017-2602LOWjenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master securitEPSS 1.6%CVE-2026-41264CRITICALFlowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityEPSS 1.4%CVE-2021-25737LOWHoles in EndpointSlice Validation Enable Host Network HijackEPSS 1.3%CVE-2026-25951HIGHFUXA has a Path Traversal Sanitization BypassEPSS 1.3%CVE-2018-16863HIGHIt was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypassEPSS 1.2%CVE-2026-56315CRITICALpicklescan - Remote Code Execution via Unblocked Standard Library ModulesEPSS 1.1%CVE-2022-32763CRITICALA cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. AEPSS 1.1%CVE-2025-48732HIGHAn incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request EPSS 1.1%CVE-2022-35962HIGHCrafted link in Zulip message can cause disclosure of credentialsEPSS 1.1%CVE-2021-1133MEDIUMCisco Data Center Network Manager REST API VulnerabilitiesEPSS 1.1%CVE-2026-87911CRITICALRead-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-serverEPSS 1.0%CVE-2026-54513HIGHjackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)EPSS 0.9%CVE-2026-47392CRITICALPraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)EPSS 0.9%CVE-2026-84218HIGHOrg.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)EPSS 0.9%CVE-2026-70470CRITICALFlowise: Pyodide validator Unicode homoglyph bypass leads to RCEEPSS 0.9%CVE-2026-54512HIGHjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationEPSS 0.9%CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS 0.8%CVE-2024-51745LOWWasmtime doesn't fully sandbox all the Windows device filenamesEPSS 0.8%CVE-2026-33396CRITICALOneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on ProbeEPSS 0.8%CVE-2025-29822HIGHMicrosoft OneNote Security Feature Bypass VulnerabilityEPSS 0.8%