Falhas do tipo CWE-358

114 resultados

Verificação de segurança insuficiente para padrões

É quando o código realiza uma validação de segurança, mas essa verificação é incompleta, genérica demais ou não cobre todos os casos necessários. O desenvolvedor assume que a validação funciona para qualquer entrada, sem considerar bordas, exceções ou variações do padrão esperado.

Exemplo

Uma aplicação verifica se uma URL começa com 'https://' antes de fazer uma requisição, mas não valida o domínio em si nem trata variações como 'https://..@domínio-malicioso.com'. O atacante contorna a validação superficial injetando credenciais falsas na URL.

Como mitigar

Use bibliotecas consolidadas para parsing e validação (Uri.Parse, URLparse) em vez de regex caseiro. Implemente testes de segurança específicos para bordas e variações do padrão, e documente exatamente qual é o escopo da validação em cada ponto crítico do código.

CVE-2024-5500MEDIUMInappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions viaEPSS 0.3%CVE-2025-62002MEDIUMBullWall Ransomware Containment file count detection bypassEPSS 0.3%CVE-2018-7685HIGHlibzypp does not reevaluate malicious rpms once downloadedEPSS 0.3%CVE-2025-69234CRITICALWhale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.EPSS 0.3%CVE-2025-66603LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attEPSS 0.3%CVE-2026-42081MEDIUMfree5GC: UE Security Capability bypass on NGAP PathSwitchRequestEPSS 0.3%CVE-2026-42082LOWfree5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverEPSS 0.3%CVE-2024-23592MEDIUMAn authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with pEPSS 0.3%CVE-2026-22618MEDIUMA security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecurEPSS 0.2%CVE-2024-41907LOWA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missinEPSS 0.2%CVE-2026-35679LOWZcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in theEPSS 0.2%CVE-2020-7251MEDIUMESConfig Tool able to edit configuration for newer versionEPSS 0.2%CVE-2026-28914MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.EPSS 0.2%CVE-2025-43262MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applieEPSS 0.2%CVE-2026-46582LOWA wildcard replay, as another piece of data, triggers poisoning in the serve expired reply pathEPSS 0.2%CVE-2024-25545HIGHAn issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework compoEPSS 0.2%CVE-2021-26328MEDIUMFailure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. EPSS 0.2%CVE-2026-54431MEDIUMImproper Data Validation in liboauth2EPSS 0.2%CVE-2025-66607MEDIUMA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting.EPSS 0.2%CVE-2026-11122MEDIUMInappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTEPSS 0.2%