Falhas do tipo CWE-427

922 resultados

Caminho de busca ou elemento não controlado

A aplicação procura por um recurso (arquivo, biblioteca, módulo) em múltiplos diretórios sem validar ou controlar a ordem de busca, permitindo que um atacante injete um arquivo malicioso em um caminho que será verificado primeiro. Isso leva a execução de código não autorizado ou bypass de controles de segurança.

Exemplo

Um programa em C carrega uma biblioteca dinâmica (DLL no Windows ou SO no Linux) procurando em diretórios listados em uma variável de ambiente. Se o atacante conseguir escrever um arquivo malicioso com o mesmo nome em um diretório anterior da busca (como o diretório atual), a aplicação carrega a versão maliciosa sem questionar.

Como mitigar

Use caminhos absolutos e hardcoded para recursos críticos; nunca confie em variáveis de ambiente para localizá-los. Valide hash ou assinatura digital de bibliotecas carregadas e restrinja permissões de escrita nos diretórios de busca apenas ao administrador.

CVE-2023-52945HIGHUncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local useEPSS 0.1%CVE-2024-34017MEDIUMLocal privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before buiEPSS 0.1%CVE-2026-40004MEDIUMopenssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartviewEPSS 0.1%CVE-2024-2207MEDIUMSound Research SECOMN64 Escalation of PrivilegeEPSS 0.1%CVE-2025-15569HIGHArtifex MuPDF win_main.c get_system_dpi uncontrolled search pathEPSS 0.1%CVE-2026-36574HIGHA DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary codEPSS 0.1%CVE-2026-26306HIGHThe installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an atEPSS 0.1%CVE-2025-7472HIGHA local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining systEPSS 0.1%CVE-2026-23740NONEAsterisk vulnerable to potential privilege escalationEPSS 0.1%CVE-2026-47570HIGHNVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from EPSS 0.1%CVE-2025-14821HIGHLibssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windowsEPSS 0.1%CVE-2025-13152HIGHA potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local auEPSS 0.1%CVE-2025-12046HIGHA DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated usEPSS 0.1%CVE-2024-55955MEDIUMAn incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 couEPSS 0.1%CVE-2025-57836HIGHAn issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions dEPSS 0.1%CVE-2026-2516HIGHUnidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search pathEPSS 0.1%CVE-2026-4545HIGHFlos Freeware Notepad2 PROPSYS.dll uncontrolled search pathEPSS 0.1%CVE-2026-50100HIGHMultiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If thiEPSS 0.1%CVE-2026-8637HIGHA potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authentEPSS 0.1%CVE-2026-41373MEDIUMOpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution PolicyEPSS 0.1%