Falhas do tipo CWE-427

922 resultados

Caminho de busca ou elemento não controlado

A aplicação procura por um recurso (arquivo, biblioteca, módulo) em múltiplos diretórios sem validar ou controlar a ordem de busca, permitindo que um atacante injete um arquivo malicioso em um caminho que será verificado primeiro. Isso leva a execução de código não autorizado ou bypass de controles de segurança.

Exemplo

Um programa em C carrega uma biblioteca dinâmica (DLL no Windows ou SO no Linux) procurando em diretórios listados em uma variável de ambiente. Se o atacante conseguir escrever um arquivo malicioso com o mesmo nome em um diretório anterior da busca (como o diretório atual), a aplicação carrega a versão maliciosa sem questionar.

Como mitigar

Use caminhos absolutos e hardcoded para recursos críticos; nunca confie em variáveis de ambiente para localizá-los. Valide hash ou assinatura digital de bibliotecas carregadas e restrinja permissões de escrita nos diretórios de busca apenas ao administrador.

CVE-2024-22346HIGHIBM i privilege escalationEPSS 0.2%CVE-2023-25779MEDIUMUncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user EPSS 0.2%CVE-2022-34396HIGH Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged autEPSS 0.2%CVE-2026-54672HIGHelectron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`EPSS 0.2%CVE-2025-23309HIGHNVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation EPSS 0.2%CVE-2026-5674HIGHPipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loadingEPSS 0.2%CVE-2026-26050HIGHThe installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead toEPSS 0.2%CVE-2026-30896HIGHThe installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some EPSS 0.2%CVE-2024-21837MEDIUMUncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user EPSS 0.2%CVE-2025-64994MEDIUMPrivilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instructionEPSS 0.2%CVE-2026-3787HIGHUltraVNC Windows Service cryptbase.dll uncontrolled search pathEPSS 0.2%CVE-2025-0041HIGHUncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged userEPSS 0.2%CVE-2026-22561MEDIUMUncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilEPSS 0.2%CVE-2025-26624MEDIUMLocal Privilege Escalation in Rufus 4.6 and previous versionsEPSS 0.2%CVE-2024-21862MEDIUMUncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated uEPSS 0.2%CVE-2024-21814MEDIUMUncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentiEPSS 0.2%CVE-2025-43950HIGHDPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLLEPSS 0.2%CVE-2025-66835HIGHTrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the useEPSS 0.2%CVE-2022-26028MEDIUMUncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially EPSS 0.2%CVE-2024-33582HIGHA DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privilegEPSS 0.2%