Falhas do tipo CWE-428

356 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2025-36384HIGHIBM Db2 Privilege EscalationEPSS 0.2%CVE-2020-37252HIGHRealtek Audio Service 1.0.0.55 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2020-37060HIGHAtomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service PathEPSS 0.2%CVE-2020-36983HIGHQuick 'n Easy FTP Service 3.2 - Unquoted Service PathEPSS 0.2%CVE-2020-36981HIGHMotorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service PathEPSS 0.2%CVE-2020-36976HIGHGlobal Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service PathEPSS 0.2%CVE-2020-36934HIGHDeep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service PathEPSS 0.2%CVE-2020-36982HIGHMotorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service PathEPSS 0.2%CVE-2020-36974HIGHRealtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service PathEPSS 0.2%CVE-2020-36975HIGHEPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service PathEPSS 0.2%CVE-2024-4461HIGHUnquoted path or search item vulnerability in SugarSyncEPSS 0.2%CVE-2021-47826HIGHAcer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47829HIGHDHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47847HIGHDisk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service PathEPSS 0.2%CVE-2021-47803HIGHiFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service PathEPSS 0.2%CVE-2020-36935HIGHKMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service PathEPSS 0.2%CVE-2021-47845HIGHSpy Emergency 25.0.650 - Unquoted Service PathEPSS 0.2%CVE-2021-47822HIGHDiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service PathEPSS 0.2%CVE-2023-22841MEDIUMUnquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(EPSS 0.2%CVE-2021-47833HIGHWifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service PathEPSS 0.2%