Fallos del tipo CWE-470

93 resultados

Reflexão insegura com entrada externa

É quando o código usa entrada do usuário (parâmetros HTTP, arquivos, etc.) para carregar classes, invocar métodos ou acessar membros via reflexão sem validação. Um atacante pode forçar o carregamento de classes maliciosas ou métodos sensíveis que não deveriam ser acessados.

Ejemplo

Um framework web aceita `?class=MinhaClasse&method=processar` e faz `Class.forName(userInput).getMethod(userMethod).invoke(obj)`. Se não validar, o atacante passa `java.lang.Runtime` e invoca `exec()` para executar comandos do sistema.

Cómo mitigar

Mantenha uma lista branca (whitelist) explícita de classes e métodos permitidos. Nunca use entrada do usuário diretamente em operações de reflexão; sempre valide contra essa lista antes de chamar `Class.forName()`, `getMethod()` ou similares.

CVE-2026-24246HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourcEPSS 0.4%CVE-2025-61925MEDIUMAstro's `X-Forwarded-Host` is reflected with no validationEPSS 0.4%CVE-2026-61599HIGHdjust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathEPSS 0.4%CVE-2026-66269HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('EPSS 0.4%CVE-2026-44339HIGHPraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeEPSS 0.4%CVE-2026-79987HIGHLow-privilege RCE through element-search eager loadingEPSS 0.4%CVE-2026-17593HIGHNexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationEPSS 0.4%CVE-2026-10853HIGHIBM MQ queue manager is vulnerable to remote code executionEPSS 0.4%CVE-2026-48517MEDIUMMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsEPSS 0.3%CVE-2026-57284MEDIUMJenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniEPSS 0.3%CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.3%CVE-2026-58659HIGHPyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterEPSS 0.3%CVE-2026-79784HIGHVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model ConfigurationEPSS 0.3%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.3%CVE-2026-54614MEDIUMDebugKit: MailPreview contains unsafe reflectionEPSS 0.3%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-61536HIGHBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEEPSS 0.3%CVE-2026-64663MEDIUMStatamic: Unsafe method invocation via Antlers template resolution allows data destructionEPSS 0.3%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.3%