Fallos del tipo CWE-470

131 resultados

Reflexão insegura com entrada externa

É quando o código usa entrada do usuário (parâmetros HTTP, arquivos, etc.) para carregar classes, invocar métodos ou acessar membros via reflexão sem validação. Um atacante pode forçar o carregamento de classes maliciosas ou métodos sensíveis que não deveriam ser acessados.

Ejemplo

Um framework web aceita `?class=MinhaClasse&method=processar` e faz `Class.forName(userInput).getMethod(userMethod).invoke(obj)`. Se não validar, o atacante passa `java.lang.Runtime` e invoca `exec()` para executar comandos do sistema.

Cómo mitigar

Mantenha uma lista branca (whitelist) explícita de classes e métodos permitidos. Nunca use entrada do usuário diretamente em operações de reflexão; sempre valide contra essa lista antes de chamar `Class.forName()`, `getMethod()` ou similares.

CVE-2026-48517MEDIUMMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsEPSS 0.3%CVE-2026-13187HIGHDialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.3%CVE-2017-20285CRITICALYAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classesEPSS 0.3%CVE-2026-57284MEDIUMJenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniEPSS 0.3%CVE-2026-104629HIGHGrid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or CodeEPSS 0.3%CVE-2026-108097HIGHDrupal core - Critical - Remote code execution - SA-CORE-2026-014EPSS 0.3%CVE-2026-112075MEDIUMunslothai unsloth sentence_transformer.py externally-controlled input to select classes or codeEPSS 0.3%CVE-2026-108099HIGHEntity List - Critical - Remote code execution - SA-CONTRIB-2026-218EPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-19135MEDIUMOpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classesEPSS 0.3%CVE-2026-23923MEDIUMUnauthenticated arbitrary PHP class instantiationEPSS 0.3%CVE-2026-111851HIGHWordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabilityEPSS 0.3%CVE-2026-106440HIGHHydra: Optuna custom_search_space can resolve and execute untrusted callables via get_methodEPSS 0.3%CVE-2026-18123HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2026-16306CRITICALCVE-2026-16306EPSS 0.2%CVE-2026-105064MEDIUMWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-102580LOWMoodle: arbitrary class instantiation via report builder audience classnameEPSS 0.2%CVE-2024-8048HIGHTelerik Reporting Insecure Expression EvaluationEPSS 0.2%CVE-2026-115749MEDIUMhydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module ImportEPSS 0.2%CVE-2026-48817MEDIUMStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`EPSS 0.2%