Fallos del tipo CWE-427

896 resultados

Busca descontrolada em caminho ou elemento

Ocorre quando uma aplicação procura por um arquivo, biblioteca ou recurso em um caminho sem validação adequada, permitindo que um atacante injete ou substitua o alvo da busca. Um adversário pode colocar um arquivo malicioso em um diretório que será encontrado primeiro, ou manipular a ordem de busca, fazendo o programa executar código não autorizado.

Ejemplo

Um programa busca por uma DLL em C:\Windows\System32 e depois no diretório atual. Se o atacante colocar uma DLL maliciosa no diretório de trabalho, ela será carregada em vez da legítima. Ou um script shell procura por um binário em PATH sem caminho absoluto — um atacante cria uma versão maliciosa em um diretório que vem antes na busca.

Cómo mitigar

Use caminhos absolutos e canonicalizados em vez de busca por caminho; valide cada etapa da resolução antes de usar o recurso; configure permissões restritivas em diretórios de busca e remova diretórios modificáveis do PATH. Em tempo de execução, carregue apenas recursos de locais pré-definidos e confiáveis.

CVE-2025-20108MEDIUMUncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authentEPSS 0.2%CVE-2023-25182MEDIUMUncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to pEPSS 0.2%CVE-2025-10581HIGHA potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a loEPSS 0.2%CVE-2025-61161HIGHDLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search paEPSS 0.2%CVE-2024-47795MEDIUMUncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potEPSS 0.2%CVE-2024-23489MEDIUMUncontrolled search path for some Intel(R) VROC software before version 8.6.0.1191 may allow an authenticated user to potentially enable escEPSS 0.2%CVE-2026-32788MEDIUMUncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User ApplicationEPSS 0.2%CVE-2025-21099MEDIUMUncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege vEPSS 0.2%CVE-2024-21769MEDIUMUncontrolled search path in some Intel(R) Ethernet Connection I219-LM install software may allow an authenticated user to potentially enableEPSS 0.2%CVE-2025-23355MEDIUMNVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A EPSS 0.2%CVE-2024-23491MEDIUMUncontrolled search path in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentialEPSS 0.2%CVE-2024-46895MEDIUMUncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an aEPSS 0.2%CVE-2026-34175MEDIUMUncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may alEPSS 0.2%CVE-2025-20015MEDIUMUncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to potenEPSS 0.2%CVE-2024-47800MEDIUMUncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privEPSS 0.2%CVE-2024-21857MEDIUMUncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enaEPSS 0.2%CVE-2025-20043MEDIUMUncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enabEPSS 0.2%CVE-2024-39833MEDIUMUncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalatioEPSS 0.2%CVE-2024-21766MEDIUMUncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to poteEPSS 0.2%CVE-2024-31073MEDIUMUncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of prEPSS 0.2%