Fallos del tipo CWE-840

99 resultados

Erros de Lógica de Negócio

É quando o código implementa corretamente a sintaxe, mas a lógica por trás não reflete as regras de negócio esperadas — permitindo operações que deveriam ser bloqueadas ou produzindo resultados incorretos. O atacante explora brechas nessas regras para contornar controles, duplicar recursos, ou chegar a estados inválidos.

Ejemplo

Um e-commerce que valida se o preço é positivo, mas não valida se o desconto pode ser maior que o preço final, permitindo que o cliente pague valor negativo. Ou um sistema que transfere saldo entre contas sem verificar se o saldo é suficiente antes de débito.

Cómo mitigar

Defina explicitamente as regras de negócio (pré e pós-condições), documente-as e implemente testes automatizados que cobram cada cenário — incluindo casos extremos e cenários de ataque. Revise a lógica de autenticação, autorização e transações críticas com produto e segurança.

CVE-2024-32999MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2024-4046MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-41965MEDIUMUse-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-58558HIGHPermission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2024-39671CRITICALAccess control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58043HIGHPermission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2026-41966MEDIUMPermission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confEPSS 0.1%CVE-2024-42034MEDIUMLaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2023-7271MEDIUMPrivilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2025-54606HIGHStatus verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability EPSS 0.1%CVE-2025-54611HIGHEXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58046MEDIUMPermission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%CVE-2025-58289MEDIUMVulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41971MEDIUMPermission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service coEPSS 0.1%CVE-2026-41968MEDIUMPermission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%CVE-2026-28550MEDIUMRace condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41973MEDIUMPermission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41961MEDIUMPermission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41967MEDIUMPermission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%