Fallos del tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2026-26862HIGHCleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual BuilEPSS 0.4%CVE-2026-53810HIGHOpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension MetadataEPSS 0.4%CVE-2024-32011HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run EPSS 0.4%CVE-2026-54918MEDIUMNetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CIEPSS 0.4%CVE-2026-28372HIGHtelnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added EPSS 0.4%CVE-2026-105080CRITICALIn ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from CaliEPSS 0.4%CVE-2026-63184HIGHRefitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusionEPSS 0.4%CVE-2026-47172CRITICALQuest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.EPSS 0.4%CVE-2026-44691HIGHIn Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be EPSS 0.4%CVE-2025-70046CRITICALAn issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master.EPSS 0.4%CVE-2026-114488HIGHWildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingEPSS 0.4%CVE-2026-114134HIGHBlack: GitHub Action installs unvalidated required-version from pyproject.tomlEPSS 0.4%CVE-2026-62680HIGHOrval: Generation-time SSRF + remote/local file inclusion via unrestricted $refEPSS 0.4%CVE-2023-31168MEDIUM Inclusion of Functionality from Untrusted Control SphereEPSS 0.4%CVE-2026-44484CRITICALCompromise of PyTorch Lightning PyPi Package VersionsEPSS 0.4%CVE-2026-45711MEDIUMMailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDsEPSS 0.4%CVE-2026-43571HIGHOpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel SetupEPSS 0.4%CVE-2026-47174CRITICALDuck Site: Untrusted pull request code can trigger privileged production deploymentEPSS 0.4%CVE-2022-46302HIGHRemote Code Execution with Root Privileges via Broad Apache PermissionsEPSS 0.4%CVE-2026-123019MEDIUMeosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphereEPSS 0.4%