Falhas do tipo CWE-427

922 resultados

Caminho de busca ou elemento não controlado

A aplicação procura por um recurso (arquivo, biblioteca, módulo) em múltiplos diretórios sem validar ou controlar a ordem de busca, permitindo que um atacante injete um arquivo malicioso em um caminho que será verificado primeiro. Isso leva a execução de código não autorizado ou bypass de controles de segurança.

Exemplo

Um programa em C carrega uma biblioteca dinâmica (DLL no Windows ou SO no Linux) procurando em diretórios listados em uma variável de ambiente. Se o atacante conseguir escrever um arquivo malicioso com o mesmo nome em um diretório anterior da busca (como o diretório atual), a aplicação carrega a versão maliciosa sem questionar.

Como mitigar

Use caminhos absolutos e hardcoded para recursos críticos; nunca confie em variáveis de ambiente para localizá-los. Valide hash ou assinatura digital de bibliotecas carregadas e restrinja permissões de escrita nos diretórios de busca apenas ao administrador.

CVE-2024-21784MEDIUMUncontrolled search path for some Intel(R) IPP Cryptography software before version 2021.11 may allow an authenticated user to potentially eEPSS 0.1%CVE-2025-20092MEDIUMUncontrolled search path for some Clock Jitter Tool software before version 6.0.1 may allow an authenticated user to potentially enable escaEPSS 0.1%CVE-2024-22184MEDIUMUncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user EPSS 0.1%CVE-2024-23907MEDIUMUncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to poteEPSS 0.1%CVE-2025-12852HIGHDLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to causeEPSS 0.1%CVE-2026-71170HIGHDell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with locEPSS 0.1%CVE-2025-40763HIGHA vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environmentEPSS 0.1%CVE-2025-54519HIGHA DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary coEPSS 0.1%CVE-2025-67450HIGHDue to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perfEPSS 0.1%CVE-2025-48503HIGHA DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting inEPSS 0.1%CVE-2026-40031HIGHMemProcFS < 5.17 DLL/Shared Library HijackingEPSS 0.1%CVE-2025-13919MEDIUMComponent Object Model (COM) Hijacking in Symantec Endpoint Protection Windows ClientEPSS 0.1%CVE-2025-20106MEDIUMUncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 20EPSS 0.1%CVE-2024-28876MEDIUMUncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enableEPSS 0.1%CVE-2024-28172MEDIUMUncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to poEPSS 0.1%CVE-2026-87530HIGHUncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to exeEPSS 0.1%CVE-2026-45004HIGHOpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working DirectoryEPSS 0.1%CVE-2025-14625MEDIUMQuartus® Prime Standard and Quartus® Prime Lite Security AdvisoryEPSS 0.1%CVE-2026-34488HIGHIP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arEPSS 0.1%CVE-2024-28953MEDIUMUncontrolled search path in some EMON software before version 11.44 may allow an authenticated user to potentially enable escalation of privEPSS 0.1%