Fallos del tipo CWE-358

114 resultados

Verificação de segurança incompleta ou inadequada para padrão

A aplicação implementa um controle ou validação de segurança, mas de forma insuficiente ou que não cobre todos os casos necessários conforme o padrão esperado. Isso deixa brechas por onde um atacante consegue contornar a proteção ou explorar cenários não previstos na validação.

Ejemplo

Um sistema valida se um arquivo tem extensão .pdf antes de aceitar upload, mas não verifica o conteúdo real do arquivo — atacante envia um executável renomeado para .pdf e consegue executá-lo. Ou um serviço autentica por IP do cliente, mas não valida o token de sessão, deixando a porta aberta para roubo de sessão.

Cómo mitigar

Implemente validações em profundidade (validar não só formato, mas conteúdo, contexto e intenção), siga padrões consolidados de segurança da sua stack (OWASP, RFC de autenticação, etc) e realize testes de contorno — tenha alguém tentando quebrar cada verificação. Code review focado em completude de controles também é crítico.

CVE-2024-5500MEDIUMInappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions viaEPSS 0.3%CVE-2025-62002MEDIUMBullWall Ransomware Containment file count detection bypassEPSS 0.3%CVE-2018-7685HIGHlibzypp does not reevaluate malicious rpms once downloadedEPSS 0.3%CVE-2025-69234CRITICALWhale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.EPSS 0.3%CVE-2025-66603LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attEPSS 0.3%CVE-2026-42081MEDIUMfree5GC: UE Security Capability bypass on NGAP PathSwitchRequestEPSS 0.3%CVE-2026-42082LOWfree5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverEPSS 0.3%CVE-2024-23592MEDIUMAn authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with pEPSS 0.3%CVE-2026-22618MEDIUMA security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecurEPSS 0.2%CVE-2024-41907LOWA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missinEPSS 0.2%CVE-2026-35679LOWZcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in theEPSS 0.2%CVE-2020-7251MEDIUMESConfig Tool able to edit configuration for newer versionEPSS 0.2%CVE-2026-28914MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.EPSS 0.2%CVE-2025-43262MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applieEPSS 0.2%CVE-2026-46582LOWA wildcard replay, as another piece of data, triggers poisoning in the serve expired reply pathEPSS 0.2%CVE-2024-25545HIGHAn issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework compoEPSS 0.2%CVE-2021-26328MEDIUMFailure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. EPSS 0.2%CVE-2026-54431MEDIUMImproper Data Validation in liboauth2EPSS 0.2%CVE-2025-66607MEDIUMA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting.EPSS 0.2%CVE-2026-11122MEDIUMInappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTEPSS 0.2%