Falhas do tipo CWE-427

922 resultados

Caminho de busca ou elemento não controlado

A aplicação procura por um recurso (arquivo, biblioteca, módulo) em múltiplos diretórios sem validar ou controlar a ordem de busca, permitindo que um atacante injete um arquivo malicioso em um caminho que será verificado primeiro. Isso leva a execução de código não autorizado ou bypass de controles de segurança.

Exemplo

Um programa em C carrega uma biblioteca dinâmica (DLL no Windows ou SO no Linux) procurando em diretórios listados em uma variável de ambiente. Se o atacante conseguir escrever um arquivo malicioso com o mesmo nome em um diretório anterior da busca (como o diretório atual), a aplicação carrega a versão maliciosa sem questionar.

Como mitigar

Use caminhos absolutos e hardcoded para recursos críticos; nunca confie em variáveis de ambiente para localizá-los. Valide hash ou assinatura digital de bibliotecas carregadas e restrinja permissões de escrita nos diretórios de busca apenas ao administrador.

CVE-2024-21857MEDIUMUncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enaEPSS 0.2%CVE-2024-22376MEDIUMUncontrolled search path element in some installation software for Intel(R) Ethernet Adapter Driver Pack before version 28.3 may allow an auEPSS 0.2%CVE-2025-0712HIGHAPM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows InstallerEPSS 0.2%CVE-2026-28704HIGHEmocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be exeEPSS 0.2%CVE-2025-57624HIGHA DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple EPSS 0.2%CVE-2023-51710MEDIUMEMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code every time the produEPSS 0.2%CVE-2023-2355MEDIUMLocal privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before bEPSS 0.2%CVE-2026-19590HIGHOpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repositoEPSS 0.2%CVE-2026-21420HIGHDell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attackeEPSS 0.2%CVE-2025-20050MEDIUMUncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escEPSS 0.2%CVE-2024-47194MEDIUMA vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in affected applicationEPSS 0.2%CVE-2026-47937HIGHAcrobat Reader | Uncontrolled Search Path Element (CWE-427)EPSS 0.2%CVE-2026-62847HIGHMetalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)EPSS 0.2%CVE-2025-24842MEDIUMUncontrolled search path for the Intel(R) System Support Utility before version 4.1.0 within Ring 3: User Applications may allow an escalatiEPSS 0.2%CVE-2024-47195MEDIUMA vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in affected applications EPSS 0.2%CVE-2025-27717MEDIUMUncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privEPSS 0.2%CVE-2024-47196MEDIUMA vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in affected applicationEPSS 0.2%CVE-2026-6421HIGHMobatek MobaXterm Home Edition msimg32.dll uncontrolled search pathEPSS 0.1%CVE-2024-23909MEDIUMUncontrolled search path in some Intel(R) FPGA SDK for OpenCL(TM) software technology may allow an authenticated user to potentially enable EPSS 0.1%CVE-2024-22184MEDIUMUncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user EPSS 0.1%