Fallos del tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2023-7357HIGHFlexNet Publisher lmadmin Rogue Vendor Daemon VulnerabilityEPSS 0.4%CVE-2026-43569HIGHOpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider AuthEPSS 0.4%CVE-2026-8879HIGHCVE-2026-8879EPSS 0.4%CVE-2026-118174MEDIUMDisplaying a message could load an attacker-chosen URL through an OpenPGP key attachmentEPSS 0.4%CVE-2026-108913HIGHomarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarcEPSS 0.4%CVE-2026-43944CRITICALelecterm: dangerous code can be run through links or command lineEPSS 0.4%CVE-2025-59828HIGHClaude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsEPSS 0.4%CVE-2026-87114HIGHKube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudoEPSS 0.4%CVE-2026-6464HIGHPostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commandsEPSS 0.4%CVE-2025-67842MEDIUMThe Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomainEPSS 0.4%CVE-2026-18408HIGHPostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql clientEPSS 0.4%CVE-2026-26079MEDIUMRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.EPSS 0.4%CVE-2025-53546CRITICALFolo allows secrets exfiltration via `pull_request_target`EPSS 0.3%CVE-2026-78019HIGHDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted ControEPSS 0.3%CVE-2023-31170MEDIUM Inclusion of Functionality from Untrusted Control SphereEPSS 0.3%CVE-2026-15519LOWusestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphereEPSS 0.3%CVE-2023-5523HIGHM-Files Web Companion allows Remote Code ExecutionEPSS 0.3%CVE-2026-63277HIGHRCE via calcext:data-mappings, sql provider and jdbc connectorEPSS 0.3%CVE-2026-32920HIGHOpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace PluginsEPSS 0.3%CVE-2026-97150HIGHWhen converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cEPSS 0.3%