Fallos del tipo CWE-706

122 resultados

Resolução incorreta de nomes ou referências

A aplicação usa um nome ou referência (variável, função, arquivo, recurso) mas resolve para um objeto diferente do esperado. Isso ocorre quando há ambiguidade na resolução de nomes — por exemplo, múltiplas definições no escopo, imports conflitantes ou path traversal — permitindo que um atacante desvie o fluxo para código ou dados não autorizados.

Ejemplo

Um programa Python importa um módulo 'utils' de um diretório local e outro de um pacote externo; se o diretório local estiver primeiro no path, a importação resolve para a versão local (potencialmente maliciosa) em vez da versão esperada. Ou um script shell usa uma variável 'temp' sem qualificar o path, resolendo para um arquivo em /tmp criado por outro usuário.

Cómo mitigar

Use imports explícitos e qualificados (nunca wildcards), mantenha paths absolutos ou relativos bem definidos, evite confiar em variáveis de ambiente não validadas para resolver recursos críticos, e realize testes de ambiguidade em linters/analisadores estáticos. Em ambientes compartilhados, controle permissões de diretórios para evitar sobrescrita de nomes.

CVE-2026-79070MEDIUMIncorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a EPSS 0.3%CVE-2026-79273MEDIUMIncorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypEPSS 0.3%CVE-2026-79264MEDIUMIncorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via EPSS 0.3%CVE-2025-12506LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-76039MEDIUMIncorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social enEPSS 0.3%CVE-2026-61844HIGHFileRise: Folder Metadata Filename Collisions Bypass "read_own" IsolationEPSS 0.3%CVE-2026-95334HIGHIncorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rendeEPSS 0.3%CVE-2025-29914MEDIUMOWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`EPSS 0.3%CVE-2026-121133HIGHIncorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-88621LOWOneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticatedEPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%CVE-2026-87720HIGHIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewEPSS 0.3%CVE-2026-106181MEDIUMIncorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-106230MEDIUMIncorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-79103LOWIncorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer EPSS 0.3%CVE-2026-25825LOWAn issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set tEPSS 0.3%CVE-2026-30856MEDIUMWeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionEPSS 0.3%CVE-2026-110156HIGHIncorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromisedEPSS 0.3%CVE-2026-106308HIGHIncorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging socialEPSS 0.3%CVE-2026-106274HIGHIncorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engiEPSS 0.3%