Fallos del tipo CWE-913

95 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

É quando a aplicação carrega, executa ou modifica código dinamicamente (via eval, reflection, desserialização, plugins) sem validação ou controle suficiente. Um atacante pode injetar código malicioso que será executado com os mesmos privilégios da aplicação, contornando controles de segurança.

Ejemplo

Uma aplicação Java que desserializa dados untrusted diretamente com ObjectInputStream permite ao atacante executar código arbitrário; ou um sistema que usa eval() em strings enviadas pelo usuário sem validação prévia.

Cómo mitigar

Nunca use eval() ou equivalentes com entrada untrusted. Se precisar executar código dinamicamente, use listas brancas estritas, sandboxes de execução ou frameworks que isolem o código dinâmico. Valide e sanitize serialização com bibliotecas seguras (ex: Java com Deserialization filters).

CVE-2024-2537MEDIUMElectron Code Injection in Logi Tune macOS ApplicationEPSS 0.3%CVE-2025-6705HIGHA vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. SpecifEPSS 0.3%CVE-2025-14695MEDIUMSamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resourcesEPSS 0.3%CVE-2026-121170HIGHImproper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a cEPSS 0.3%CVE-2026-5251MEDIUMz-9527 admin User Update Endpoint user.js dynamically-determined object attributesEPSS 0.2%CVE-2026-5248MEDIUMgougucms User Registration Login.php reg_submit dynamically-determined object attributesEPSS 0.2%CVE-2026-48775MEDIUMLangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingEPSS 0.2%CVE-2026-116612HIGHA flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline descriptEPSS 0.2%CVE-2026-48105HIGHArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveEPSS 0.2%CVE-2025-9905HIGHArbitary Code execution in Keras load_model()EPSS 0.2%CVE-2026-62848HIGHMetalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionEPSS 0.2%CVE-2026-48700CRITICALAn issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktEPSS 0.2%CVE-2025-54065HIGHGZDoom engine allows arbitrary code execution via ZScript actor statesEPSS 0.1%CVE-2025-26405MEDIUMImproper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of EPSS 0.1%CVE-2026-102734MEDIUMasteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval InterpreterEPSS 0.1%