Fallos del tipo CWE-913

86 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

É quando a aplicação carrega, executa ou modifica código dinamicamente (via eval, reflection, desserialização, plugins) sem validação ou controle suficiente. Um atacante pode injetar código malicioso que será executado com os mesmos privilégios da aplicação, contornando controles de segurança.

Ejemplo

Uma aplicação Java que desserializa dados untrusted diretamente com ObjectInputStream permite ao atacante executar código arbitrário; ou um sistema que usa eval() em strings enviadas pelo usuário sem validação prévia.

Cómo mitigar

Nunca use eval() ou equivalentes com entrada untrusted. Se precisar executar código dinamicamente, use listas brancas estritas, sandboxes de execução ou frameworks que isolem o código dinâmico. Valide e sanitize serialização com bibliotecas seguras (ex: Java com Deserialization filters).

CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-23830CRITICALSandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorEPSS 1.2%CVE-2020-25803MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.EPSS 1.1%CVE-2020-25802MEDIUMAuthenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.EPSS 1.1%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%CVE-2022-44000CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbEPSS 1.0%CVE-2025-6384HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.0%CVE-2022-3225HIGHImproper Control of Dynamically-Managed Code Resources in budibase/budibaseEPSS 0.9%CVE-2021-23267HIGHImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 0.9%CVE-2023-37271HIGHRestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapeEPSS 0.8%CVE-2022-39051MEDIUMPerl Code execution in Template ToolkitEPSS 0.8%CVE-2026-47208CRITICALvm2: Sandbox Breakout Using Promise SpeciesEPSS 0.8%CVE-2021-21413HIGHMisuse of `Reference` and other transferable APIs may lead to access to nodejs isolateEPSS 0.7%CVE-2026-47698CRITICALvm2: Sandbox Breakout Using Dangerous Host Proto MutatorsEPSS 0.7%CVE-2021-23259MEDIUMGroovy Sandbox BypassEPSS 0.7%CVE-2021-23258MEDIUMSpring SPEL Expression Language InjectionEPSS 0.7%CVE-2025-69219HIGHApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorEPSS 0.7%CVE-2026-41870HIGHApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2022-31764HIGHApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCEPSS 0.7%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.7%