Fallos del tipo CWE-829

291 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2023-0625HIGHDocker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelogEPSS 0.9%CVE-2021-41037CRITICALIn Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installatiEPSS 0.8%CVE-2026-57102HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2025-62726HIGHn8n Vulnerable to Remote Code Execution via Git Node Pre-Commit HookEPSS 0.8%CVE-2026-40501HIGHCherry Studio RCE via SearchService nodeIntegration MisconfigurationEPSS 0.8%CVE-2025-34060CRITICALMonero Forum Remote Code Execution via Arbitrary File Read and Cookie ForgeryEPSS 0.8%CVE-2026-93993HIGHMistral Vibe before 2.25.5 Remote Code Execution via git post-checkoutEPSS 0.8%CVE-2022-22246HIGHJunos OS: PHP file inclusion vulnerability in J-WebEPSS 0.8%CVE-2022-24119CRITICALCertain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shellEPSS 0.8%CVE-2025-8714HIGHPostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql clientEPSS 0.8%CVE-2025-68924HIGHIn Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remEPSS 0.8%CVE-2025-70974CRITICALFastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a JavaEPSS 0.7%CVE-2024-28184HIGHWeasyPrint allows the attachment of arbitrary files and URLs to a PDFEPSS 0.7%CVE-2026-76139HIGHAcm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialsEPSS 0.7%CVE-2025-66022CRITICALFACTION Unauthenticated Custom Extension Upload leads to RCEEPSS 0.7%CVE-2026-66902CRITICALGoogle::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system callEPSS 0.7%CVE-2023-36609HIGH The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpEPSS 0.7%CVE-2023-45798HIGHYettiesoft VestCert Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-30092HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-27668CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via IfrEPSS 0.7%