Falhas do tipo CWE-178

117 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Ocorre quando o código não trata corretamente diferenças entre maiúsculas e minúsculas em strings, permitindo que um atacante contorne validações, filtros de segurança ou lógica de autorização. Por exemplo, se um firewall bloqueia 'admin.php' mas aceita 'ADMIN.PHP', a proteção é burlada.

Exemplo

Uma aplicação valida extensões bloqueadas comparando contra lista em minúsculas (.exe, .bat), mas o usuário faz upload de 'arquivo.EXE' ou 'arquivo.ExE' que passa pela validação por falta de normalização da entrada antes da comparação.

Como mitigar

Normalize todas as strings para um padrão único (toLowerCase() ou toUpperCase()) antes de qualquer comparação de segurança. Sempre considere o contexto do sistema operacional ou banco de dados — Windows ignora case em caminhos, mas Linux não — e aplique as mesmas regras que o ambiente subjacente usa.

CVE-2026-62673HIGHGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsEPSS 0.5%CVE-2026-29054HIGHTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)EPSS 0.5%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2026-83612HIGHxmldom: HTML raw-text closing-tag case mismatch causes output amplificationEPSS 0.5%CVE-2026-82726MEDIUMAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantEPSS 0.5%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.5%CVE-2025-59944HIGHCursor IDE: Sensitive File Overwrite Bypass is PossibleEPSS 0.5%CVE-2026-82067CRITICALImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupEPSS 0.5%CVE-2026-43513HIGHApache Tomcat: LockOutRealm treats user names as case-sensitiveEPSS 0.5%CVE-2025-50864MEDIUMAn Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictionEPSS 0.5%CVE-2026-106503HIGHBackstage: Scaffolder action input authorization bypassEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%CVE-2026-48595HIGHAuthorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsEPSS 0.5%CVE-2026-32939HIGHDataEase is Vulnerable to H2 JDBC RCE BypassEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-71315HIGHNuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)EPSS 0.5%CVE-2026-89012HIGHDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterEPSS 0.5%CVE-2026-15573HIGHKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherEPSS 0.5%CVE-2026-74041HIGHWazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case MismatchEPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%