Falhas do tipo CWE-184

245 resultados

Lista incompleta de entradas bloqueadas

Quando um aplicativo tenta bloquear entradas perigosas (como caracteres especiais, palavras-chave ou padrões maliciosos), mas a lista de bloqueio é incompleta ou mal pensada, um atacante consegue contornar a proteção usando variações não previstas. É a falsa sensação de segurança: o desenvolvedor acredita estar protegido, mas deixa brechas.

Exemplo

Um formulário web bloqueia a palavra 'script' para evitar XSS, mas não bloqueia 'sCrIpT' com letras maiúsculas, ou '\x3cscript' em hexadecimal. Um atacante injeta uma dessas variações e consegue executar JavaScript malicioso, burlando a proteção.

Como mitigar

Em vez de manter listas de bloqueio (blacklist), use whitelist: aceite apenas entradas conhecidas como seguras, validate com regex rigorosa e, quando possível, escape ou sanitize output com bibliotecas consolidadas (DOMPurify, OWASP, etc). Prefira validação estruturada sobre verificações ad-hoc.

CVE-2026-108471HIGHWindows Virtualization-Based Security (VBS) Enclave Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-22175HIGHOpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell WrappersEPSS 0.4%CVE-2026-102829CRITICALsimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionEPSS 0.4%CVE-2026-31992HIGHOpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -SEPSS 0.4%CVE-2026-32128MEDIUMFastGPT Python Sandbox Bypass of File-Write RestrictionEPSS 0.3%CVE-2026-40893HIGHGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and MoveEPSS 0.3%CVE-2026-113663HIGHAG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command executionEPSS 0.3%CVE-2026-85787HIGHAn incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverEPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2026-45066LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationEPSS 0.3%CVE-2026-45753LOWSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)EPSS 0.3%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.3%CVE-2026-105650HIGHGhost: Stored XSS via oEmbed Photo ResponsesEPSS 0.3%CVE-2026-56777MEDIUMn8n - AST Validator Bypass in Python Code NodeEPSS 0.3%CVE-2026-16129MEDIUMprincezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklistEPSS 0.3%CVE-2026-18174MEDIUM@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-ForEPSS 0.3%CVE-2026-106218HIGHIn JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possibleEPSS 0.3%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2026-34425MEDIUMOpenClaw - Shell-Bleed Protection Preflight Validation BypassEPSS 0.3%CVE-2026-73078HIGHVim: Arbitrary Code Execution via Netrw Menu ConstructionEPSS 0.3%