Fallos del tipo CWE-506

100 resultados

Código malicioso incorporado

É quando código malicioso é deliberadamente inserido dentro de um software legítimo durante o desenvolvimento, compilação ou distribuição. O atacante consegue executar ações não autorizadas (roubo de dados, backdoors, sabotagem) porque o código malicioso está embutido no binário confiável.

Ejemplo

Um desenvolvedor com acesso ao repositório insere silenciosamente código que envia credenciais de usuários para um servidor externo; ou um fornecedor de biblioteca terceira injeta um keylogger que ativa após a instalação. A vítima só descobre quando o dano já está feito.

Cómo mitigar

Implemente: (1) revisão de código rigorosa e assinatura digital de commits; (2) análise estática e dinâmica automática (SAST/DAST) no pipeline CI/CD; (3) verificação de integridade e autenticidade de dependências e pacotes; (4) auditoria de acessos a repositórios e build systems; (5) sandboxing e princípio de menor privilégio em produção.

CVE-2026-66747CRITICALENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root ImplantEPSS 0.7%CVE-2025-10894CRITICALNx: nx/devkit: malicious versions of nx and plugins published to npmEPSS 0.6%CVE-2026-34424CRITICALSmart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitEPSS 0.6%CVE-2017-20202CRITICALWeb Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2017-20201CRITICALCCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain CompromiseEPSS 0.5%CVE-2026-67595CRITICALVaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.phpEPSS 0.5%CVE-2026-46421CRITICALSupply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)EPSS 0.5%CVE-2026-31976CRITICALxygeni-action v5 tag poisoned with C2 backdoorEPSS 0.5%CVE-2026-6443CRITICALEssentialplugin Plugins (Various Versions) - Injected BackdoorEPSS 0.5%CVE-2025-59145HIGHcolor-name@2.0.1 contains malware after npm account takeoverEPSS 0.5%CVE-2026-48159CRITICALuse-reducer-async was vulnerable to malicious code execution via compromised commitsEPSS 0.5%CVE-2026-74232CRITICALZbtlink MQWrt yunmgrd Cloud C2 ImplantEPSS 0.5%CVE-2026-73532CRITICALFluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.5%CVE-2026-28353CRITICALTrivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension ReleaseEPSS 0.5%CVE-2026-77651CRITICALThe arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a roEPSS 0.5%CVE-2026-73533CRITICALNinja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin BuildEPSS 0.4%CVE-2018-25117CRITICALVestaCP Debian Installer Malicious Backdoor Supply Chain CompromiseEPSS 0.4%CVE-2026-77650CRITICALThe append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it haEPSS 0.4%CVE-2026-77649CRITICALThe internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rEPSS 0.4%CVE-2026-48161CRITICALreact18-use was vulnerable to malicious code execution via compromised commitsEPSS 0.4%