Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2026-2542HIGHTotal VPN win-service.exe unquoted search pathEPSS 0.2%CVE-2025-8070CRITICALWindows service registered with an unquoted ImagePath vulnerability in the system registryEPSS 0.2%CVE-2023-54353HIGHChromacam 4.0.3.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2020-37254HIGHWondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service PathEPSS 0.2%CVE-2022-36384MEDIUMUnquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may alEPSS 0.2%CVE-2019-25747HIGHNetwork Inventory Advisor 5.0.26.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2016-20093HIGHWise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2016-20088HIGHComodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2016-20087HIGHFortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of PrivilegeEPSS 0.2%CVE-2016-20089HIGHIperius Remote 1.7.0 Unquoted Service Path Elevation of PrivilegeEPSS 0.2%CVE-2016-20092HIGHNetDrive 2.6.12 Unquoted Service Path Elevation of PrivilegeEPSS 0.2%CVE-2016-20090HIGHComodo Dragon Browser 52.15.25.663 Privilege Escalation via Unquoted Service PathEPSS 0.2%CVE-2020-36989HIGHForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service PathEPSS 0.2%CVE-2020-36985HIGHIP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service PathEPSS 0.2%CVE-2020-36990HIGHInput Director 1.4.3 - 'Input Director' Unquoted Service PathEPSS 0.2%CVE-2025-58400HIGHRATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user witEPSS 0.2%CVE-2020-36992HIGHNord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service PathEPSS 0.2%CVE-2019-25288HIGHWacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service PathEPSS 0.2%CVE-2019-25292HIGHAlps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service PathEPSS 0.2%CVE-2020-36984HIGHEPSON 1.124 - 'seksmdb.exe' Unquoted Service PathEPSS 0.2%