Fallos del tipo CWE-829

242 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2026-59864CRITICALKiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsEPSS 1.3%CVE-2022-23630HIGHDependency verification bypass in GradleEPSS 1.3%CVE-2021-29427HIGHRepository content filters do not work in Settings pluginManagementEPSS 1.3%CVE-2019-11770—In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPEPSS 1.3%CVE-2018-1122HIGHprocps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-contEPSS 1.2%CVE-2021-41256MEDIUMIntent URI permissions manipulation in nextcloud news-androidEPSS 1.1%CVE-2026-71471CRITICALAcm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container imageEPSS 1.0%CVE-2022-24824MEDIUMAnonymous user cache poisoning in discourseEPSS 1.0%CVE-2023-26053MEDIUMGradle usage of long IDs for PGP keys opens potential for collision attacksEPSS 1.0%CVE-2026-43003HIGHAn issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install froEPSS 1.0%CVE-2026-43999CRITICALvm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapeEPSS 1.0%CVE-2025-20236HIGHCisco Webex App Client-Side Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-22208CRITICALOpenS100 Portrayal Engine Unrestricted Lua Standard Library AccessEPSS 0.9%CVE-2022-34468HIGHAn iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affecEPSS 0.9%CVE-2026-58116CRITICALLLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model PathEPSS 0.9%CVE-2023-2453HIGHLocal file Inclusion (LFI) in Forum Infusion via Directory TraversalEPSS 0.9%CVE-2021-41037CRITICALIn Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installatiEPSS 0.8%CVE-2026-57102HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-40501HIGHCherry Studio RCE via SearchService nodeIntegration MisconfigurationEPSS 0.8%CVE-2026-62902MEDIUM.NET Information Disclosure VulnerabilityEPSS 0.8%