Fallos del tipo CWE-426

351 resultados

Busca em caminho não confiável

Ocorre quando uma aplicação procura por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo não é totalmente controlado, permitindo que um atacante injete uma versão maliciosa de um arquivo antes da legítima ser encontrada. O risco é a execução de código não autorizado com os privilégios da aplicação.

Ejemplo

Uma aplicação precisa carregar a biblioteca 'libssl.so'. Se o PATH inclui o diretório /tmp antes de /usr/lib, um atacante coloca uma libssl.so maliciosa em /tmp — a aplicação carregará a falsa sem saber. Comum em scripts e instaladores que não usam caminhos absolutos.

Cómo mitigar

Use caminhos absolutos e completos ao fazer busca de arquivos críticos (não confie em PATH ou variáveis de ambiente). Valide integridade e propriedade de arquivos encontrados; configure o PATH explicitamente apenas com diretórios confiáveis; em sistemas Unix, remova '.' e /tmp da ordem de busca.

CVE-2023-27765HIGHAn issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoveritEPSS 0.4%CVE-2023-27764HIGHAn issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_seEPSS 0.4%CVE-2023-27767HIGHAn issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setuEPSS 0.4%CVE-2023-27769HIGHAn issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreaderEPSS 0.4%CVE-2026-48565HIGHWindows Narrator Braille Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-7279MEDIUMDLL search order hijacking in Host IPSEPSS 0.4%CVE-2024-55503LOWAn issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES compoEPSS 0.4%CVE-2026-83509HIGHWindows Setup Files Cleanup Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-7476—A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of mEPSS 0.4%CVE-2020-9287HIGHA untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitableEPSS 0.4%CVE-2023-29299MEDIUMAdobe Acrobat Reader Untrusted Search Path Application denial-of-serviceEPSS 0.4%CVE-2020-6654HIGHDLL HijackingEPSS 0.4%CVE-2019-25257HIGHLogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path ManipulationEPSS 0.4%CVE-2021-25699—The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, whiEPSS 0.4%CVE-2021-25698—The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, whicEPSS 0.4%CVE-2026-83506HIGHServicing Stack Updates Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-31012HIGHGit for Windows' installer can be tricked into executing an untrusted binaryEPSS 0.4%CVE-2021-28246HIGHCA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regulaEPSS 0.4%CVE-2023-27759HIGHAn issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCEPSS 0.4%CVE-2025-12819HIGHUntrusted search path in auth_query connection in PgBouncerEPSS 0.4%