Fallos del tipo CWE-829

317 resultados

Inclusão de funcionalidade de fonte não confiável

Ocorre quando uma aplicação carrega ou executa código, bibliotecas ou componentes originários de uma fonte não verificada ou controlada por terceiros. O risco é alto porque o código malicioso ou comprometido executa com os mesmos privilégios da aplicação, permitindo roubo de dados, injeção de código ou compromisso total do sistema.

Ejemplo

Um aplicativo web busca um script JavaScript de um CDN externo sem validar assinatura criptográfica. Se o CDN for comprometido ou o tráfego interceptado, o atacante injeta código que rouba credenciais dos usuários. Outro caso: uma dependência npm instalada automaticamente é atualizada e passa a conter malware, afetando todos os projetos que a consomem.

Cómo mitigar

Valide a origem e integridade de componentes: use subresource integrity (SRI) para scripts externos, verifique assinaturas digitais de pacotes, mantenha dependências em repositório privado controlado, e audite regularmente bibliotecas críticas com ferramentas como npm audit ou SBOM. Implemente listas de permissão (whitelist) de fontes confiáveis e isole a execução quando possível.

CVE-2026-73367HIGHWordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerabilityEPSS 0.3%CVE-2026-28500HIGHONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain AttackEPSS 0.3%CVE-2026-114727HIGHRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS EPSS 0.3%CVE-2022-4134LOWA flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrEPSS 0.3%CVE-2026-59831MEDIUMGitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious CodespaceEPSS 0.3%CVE-2025-41390HIGHAn arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repEPSS 0.3%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2022-33317HIGHInclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, MitsubishEPSS 0.3%CVE-2026-83493CRITICALDistributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@masterEPSS 0.3%CVE-2026-118178MEDIUMRSS feed could redirect its subscription to a local file or network shareEPSS 0.3%CVE-2026-22551MEDIUMIn Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitraryEPSS 0.3%CVE-2026-122160MEDIUMmyshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphereEPSS 0.3%CVE-2026-33075CRITICALFastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.ymlEPSS 0.3%CVE-2026-40154CRITICALPraisonAI Affected by Untrusted Remote Template Code ExecutionEPSS 0.3%CVE-2026-40313CRITICALPraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential PersistenceEPSS 0.3%CVE-2026-50195MEDIUMcontainerd: CRI checkpoint import allows local image tag poisoningEPSS 0.3%CVE-2026-55698HIGHpnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesEPSS 0.3%CVE-2026-87695HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-12509HIGHScripts for the module Global_Shipping executable on BRAIN2 ServerEPSS 0.3%CVE-2026-115802MEDIUMInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphereEPSS 0.3%