Falhas do tipo CWE-426

299 resultados

Caminho de busca não confiável

A aplicação procura por arquivos ou bibliotecas em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Ao carregar uma DLL, biblioteca dinâmica ou executável sem validar o caminho completo, o programa pode ser enganado a usar um arquivo malicioso plantado em um local que é percorrido antes do legítimo.

Exemplo

Um programa Windows que carrega 'msvcrt.dll' sem especificar o caminho completo. Se o atacante coloca uma DLL maliciosa com o mesmo nome no diretório de trabalho ou em um PATH que a aplicação vasculha primeiro, a versão maliciosa é carregada em vez da legítima — permitindo execução de código arbitrário.

Como mitigar

Sempre especifique o caminho absoluto completo ao carregar bibliotecas dinâmicas ou executáveis; use mecanismos da plataforma (como LoadLibraryEx no Windows com LOAD_LIBRARY_SEARCH_SYSTEM32) que restringem o escopo de busca; valide a integridade e assinatura dos arquivos antes de carregar; remova diretórios inseguros da variável PATH da aplicação.

CVE-2016-10009HIGHUntrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCEPSS 37.4%CVE-2012-1854HIGHUntrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual BasiEPSS 21.0%KEVCVE-2022-22047HIGHWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityEPSS 17.1%KEVCVE-2010-3190HIGHUntrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio EPSS 9.1%CVE-2024-26198HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 6.8%CVE-2022-41953HIGHGit clone remote code execution vulnerability in git-for-windowsEPSS 6.8%CVE-2023-30330CRITICALSoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defauEPSS 5.9%CVE-2023-36778HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 3.7%CVE-2024-13158HIGHAn unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowEPSS 3.3%CVE-2018-10904HIGHIt was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by EPSS 3.0%CVE-2023-36003MEDIUMXAML Diagnostics Elevation of Privilege VulnerabilityEPSS 2.8%CVE-2025-23266CRITICALNVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could EPSS 2.6%CVE-2023-36780HIGHSkype for Business Remote Code Execution VulnerabilityEPSS 2.6%CVE-2019-5429—Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's homEPSS 2.5%CVE-2011-4125—A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute aEPSS 2.2%CVE-2022-24826CRITICALGit LFS can execute a binary from the current directory on WindowsEPSS 2.1%CVE-2023-26031HIGHPrivilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsEPSS 2.1%CVE-2024-21435HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-41766HIGHWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2019-6826—A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code executEPSS 1.2%