Fallos del tipo CWE-427

896 resultados

Busca descontrolada em caminho ou elemento

Ocorre quando uma aplicação procura por um arquivo, biblioteca ou recurso em um caminho sem validação adequada, permitindo que um atacante injete ou substitua o alvo da busca. Um adversário pode colocar um arquivo malicioso em um diretório que será encontrado primeiro, ou manipular a ordem de busca, fazendo o programa executar código não autorizado.

Ejemplo

Um programa busca por uma DLL em C:\Windows\System32 e depois no diretório atual. Se o atacante colocar uma DLL maliciosa no diretório de trabalho, ela será carregada em vez da legítima. Ou um script shell procura por um binário em PATH sem caminho absoluto — um atacante cria uma versão maliciosa em um diretório que vem antes na busca.

Cómo mitigar

Use caminhos absolutos e canonicalizados em vez de busca por caminho; valide cada etapa da resolução antes de usar o recurso; configure permissões restritivas em diretórios de busca e remova diretórios modificáveis do PATH. Em tempo de execução, carregue apenas recursos de locais pré-definidos e confiáveis.

CVE-2026-28760HIGHThe installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to plaEPSS 0.2%CVE-2024-31407MEDIUMUncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before vEPSS 0.2%CVE-2025-5470HIGHDylib Hijacking in Yandex DiskEPSS 0.2%CVE-2024-34165MEDIUMUncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially enaEPSS 0.2%CVE-2024-34164MEDIUMUncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable escaEPSS 0.2%CVE-2024-23312MEDIUMUncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated usEPSS 0.2%CVE-2024-35245MEDIUMUncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated EPSS 0.2%CVE-2024-28950MEDIUMUncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated EPSS 0.2%CVE-2024-37024MEDIUMUncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to EPSS 0.2%CVE-2024-34028MEDIUMUncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, grEPSS 0.2%CVE-2025-26861HIGHRemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a craEPSS 0.2%CVE-2022-36380MEDIUMUncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 maEPSS 0.2%CVE-2024-21841MEDIUMUncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentiallEPSS 0.2%CVE-2022-26028MEDIUMUncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially EPSS 0.2%CVE-2024-28952MEDIUMUncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially EPSS 0.2%CVE-2025-26860HIGHRemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 contain an uncontrolled search path element vulnerability. If a craEPSS 0.2%CVE-2024-36245MEDIUMUncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potEPSS 0.2%CVE-2022-26086MEDIUMUncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to pEPSS 0.2%CVE-2024-21818MEDIUMUncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalatioEPSS 0.2%CVE-2024-22379MEDIUMUncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escEPSS 0.2%