Fallos del tipo CWE-470

134 resultados

Reflexão insegura com entrada externa

É quando o código usa entrada do usuário (parâmetros HTTP, arquivos, etc.) para carregar classes, invocar métodos ou acessar membros via reflexão sem validação. Um atacante pode forçar o carregamento de classes maliciosas ou métodos sensíveis que não deveriam ser acessados.

Ejemplo

Um framework web aceita `?class=MinhaClasse&method=processar` e faz `Class.forName(userInput).getMethod(userMethod).invoke(obj)`. Se não validar, o atacante passa `java.lang.Runtime` e invoca `exec()` para executar comandos do sistema.

Cómo mitigar

Mantenha uma lista branca (whitelist) explícita de classes e métodos permitidos. Nunca use entrada do usuário diretamente em operações de reflexão; sempre valide contra essa lista antes de chamar `Class.forName()`, `getMethod()` ou similares.

CVE-2026-82894—Apache OFBiz: Content renderer runs a service name stored on the rowEPSS 0.5%CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-49287HIGHStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionEPSS 0.5%CVE-2026-106439HIGHHydra: Mutable instantiate policy sets allow target blocklist bypassEPSS 0.5%CVE-2026-68508HIGHHydra: hydra.utils.instantiate with untrusted config can lead to code executionEPSS 0.5%CVE-2026-92206HIGHCrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-119084CRITICALRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection ParametersEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-46718MEDIUMApache Calcite: A user-controled model can load arbitrary classes, leading to code executionEPSS 0.4%CVE-2026-24246HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourcEPSS 0.4%CVE-2026-119050CRITICALAgno through 3.1.11 Code Execution via PandasTools Unsafe ReflectionEPSS 0.4%CVE-2026-112145MEDIUMspeaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or codeEPSS 0.4%CVE-2026-78030CRITICALDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMEPSS 0.4%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.4%CVE-2026-108099HIGHEntity List - Critical - Remote code execution - SA-CONTRIB-2026-218EPSS 0.4%CVE-2025-61925MEDIUMAstro's `X-Forwarded-Host` is reflected with no validationEPSS 0.4%CVE-2026-96740MEDIUMStreamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providersEPSS 0.4%CVE-2026-114508MEDIUMLaravel relationship inclusion can trigger unauthorized data destructionEPSS 0.4%CVE-2026-64663MEDIUMStatamic: Unsafe method invocation via Antlers template resolution allows data destructionEPSS 0.4%CVE-2026-71253CRITICALApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONEPSS 0.4%