Falhas do tipo CWE-358

114 resultados

Verificação de segurança insuficiente para padrões

É quando o código realiza uma validação de segurança, mas essa verificação é incompleta, genérica demais ou não cobre todos os casos necessários. O desenvolvedor assume que a validação funciona para qualquer entrada, sem considerar bordas, exceções ou variações do padrão esperado.

Exemplo

Uma aplicação verifica se uma URL começa com 'https://' antes de fazer uma requisição, mas não valida o domínio em si nem trata variações como 'https://..@domínio-malicioso.com'. O atacante contorna a validação superficial injetando credenciais falsas na URL.

Como mitigar

Use bibliotecas consolidadas para parsing e validação (Uri.Parse, URLparse) em vez de regex caseiro. Implemente testes de segurança específicos para bordas e variações do padrão, e documente exatamente qual é o escopo da validação em cada ponto crítico do código.

CVE-2025-25255MEDIUMAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPrEPSS 0.4%CVE-2026-65058MEDIUMTrezor Safe improper security check in on-device displayEPSS 0.4%CVE-2025-10457MEDIUMBluetooth: Out-Of-Context le_conn_rsp HandlingEPSS 0.4%CVE-2021-21387HIGHPartial secret key disclosure, improper safety number calculation, & inadequate encryption strengthEPSS 0.4%CVE-2024-36511LOWAn improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4EPSS 0.4%CVE-2025-3069HIGHInappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalationEPSS 0.4%CVE-2023-39403CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2025-62585HIGHWhale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.EPSS 0.4%CVE-2025-59147HIGHSuricata is Vulnerable to Detection Bypass via Crafted Multiple SYN PacketsEPSS 0.4%CVE-2024-12056LOWClient Secret not checked with OAuth Password grant typeEPSS 0.4%CVE-2024-55599MEDIUMAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all verEPSS 0.3%CVE-2024-3838MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicEPSS 0.3%CVE-2026-49783HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2024-27842HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with keEPSS 0.3%CVE-2026-48797CRITICALBackpropagate: backprop ui --auth and backprop ui --share do not enforce authenticationEPSS 0.3%CVE-2025-13333MEDIUMIBM WebSphere Application Server could provide weaker than expected securityEPSS 0.3%CVE-2025-66600HIGHA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport SeEPSS 0.3%CVE-2020-9295MEDIUMFortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 runningEPSS 0.3%CVE-2025-49011LOWSpiceDB checks involving relations with caveats can result in no permission when permission is expectedEPSS 0.3%CVE-2020-8352LOWIn some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.EPSS 0.3%