Fallos del tipo CWE-436

115 resultados

Conflito de Interpretação

Ocorre quando diferentes componentes ou camadas da aplicação interpretam o mesmo dado de formas distintas, levando a decisões de segurança inconsistentes. Um validador pode considerar uma entrada segura enquanto um processador posterior a interpreta de modo diferente, abrindo brecha para bypass de controles.

Ejemplo

Um WAF valida a URL decodificando %2e%2e (..), mas o servidor web interpreta sequências de escape de forma distinta e permite traversal de diretório. Ou um filtro XSS bloqueia '<script>' mas a aplicação JavaScript interpreta a mesma string codificada como código executável.

Cómo mitigar

Normalize e valide dados uma única vez, no ponto mais próximo de entrada, usando a mesma codificação e regras que o processador final usará. Implemente testes que verifiquem que validador e processador concordam na interpretação, inclusive com variações de codificação (UTF-8, URL encoding, HTML entities).

CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2025-24013MEDIUMCodeIgniter validation of header name and valueEPSS 0.5%CVE-2026-33808CRITICAL@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)EPSS 0.5%CVE-2026-13676HIGHfast-uri vulnerable to host confusion via failed IDN canonicalizationEPSS 0.5%CVE-2023-49284LOWCommand substitution output can trigger shell expansion in fish shellEPSS 0.5%CVE-2026-44974HIGHParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parametersEPSS 0.5%CVE-2022-48230HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS.EPSS 0.5%CVE-2022-48261HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause theEPSS 0.5%CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.5%CVE-2026-73614HIGHNetwork-AI ClaudeHookBridge Deny Pattern Bypass via TruncationEPSS 0.4%CVE-2026-57580CRITICALauthentik: Account Takeover via SAML NameID Comment TruncationEPSS 0.4%CVE-2022-48471HIGHThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer sEPSS 0.4%CVE-2024-29034MEDIUMCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedEPSS 0.4%CVE-2024-3386MEDIUMPAN-OS: Predefined Decryption Exclusions Does Not Work as IntendedEPSS 0.4%CVE-2026-18427HIGH@fastify/static vulnerable to route guard bypass via non-canonical path segmentsEPSS 0.4%CVE-2026-33807CRITICAL@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopesEPSS 0.4%CVE-2024-24753MEDIUMBref Multiple Value Headers Not Supported in ApiGatewayFormatV2EPSS 0.4%CVE-2023-40718MEDIUMA interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packeEPSS 0.4%CVE-2026-68968HIGHApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill idEPSS 0.4%CVE-2026-0958HIGHInterpretation Conflict in GitLabEPSS 0.4%