Falhas do tipo CWE-358

119 resultados

Verificação de segurança insuficiente para padrões

É quando o código realiza uma validação de segurança, mas essa verificação é incompleta, genérica demais ou não cobre todos os casos necessários. O desenvolvedor assume que a validação funciona para qualquer entrada, sem considerar bordas, exceções ou variações do padrão esperado.

Exemplo

Uma aplicação verifica se uma URL começa com 'https://' antes de fazer uma requisição, mas não valida o domínio em si nem trata variações como 'https://..@domínio-malicioso.com'. O atacante contorna a validação superficial injetando credenciais falsas na URL.

Como mitigar

Use bibliotecas consolidadas para parsing e validação (Uri.Parse, URLparse) em vez de regex caseiro. Implemente testes de segurança específicos para bordas e variações do padrão, e documente exatamente qual é o escopo da validação em cada ponto crítico do código.

CVE-2024-27842HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with keEPSS 0.3%CVE-2026-48797CRITICALBackpropagate: backprop ui --auth and backprop ui --share do not enforce authenticationEPSS 0.3%CVE-2020-9295MEDIUMFortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 runningEPSS 0.3%CVE-2025-66603LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attEPSS 0.3%CVE-2020-8352LOWIn some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.EPSS 0.3%CVE-2018-7685HIGHlibzypp does not reevaluate malicious rpms once downloadedEPSS 0.3%CVE-2024-5500MEDIUMInappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions viaEPSS 0.3%CVE-2025-69234CRITICALWhale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.EPSS 0.3%CVE-2025-62002MEDIUMBullWall Ransomware Containment file count detection bypassEPSS 0.3%CVE-2026-42081MEDIUMfree5GC: UE Security Capability bypass on NGAP PathSwitchRequestEPSS 0.3%CVE-2026-42082LOWfree5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverEPSS 0.3%CVE-2024-23592MEDIUMAn authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with pEPSS 0.3%CVE-2026-22618MEDIUMA security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecurEPSS 0.2%CVE-2024-41907LOWA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missinEPSS 0.2%CVE-2026-35679LOWZcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in theEPSS 0.2%CVE-2020-7251MEDIUMESConfig Tool able to edit configuration for newer versionEPSS 0.2%CVE-2025-66607MEDIUMA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting.EPSS 0.2%CVE-2026-28914MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.EPSS 0.2%CVE-2025-43262MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applieEPSS 0.2%CVE-2021-26328MEDIUMFailure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. EPSS 0.2%