Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2020-36992HIGHNord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service PathEPSS 0.2%CVE-2020-36985HIGHIP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service PathEPSS 0.2%CVE-2023-6631HIGHSubnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or ElementEPSS 0.2%CVE-2020-36986HIGHPrey 1.9.6 - "CronService" Unquoted Service PathEPSS 0.2%CVE-2020-36991HIGHShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service PathEPSS 0.2%CVE-2020-37252HIGHRealtek Audio Service 1.0.0.55 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2016-20095HIGHMatrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege EscalationEPSS 0.2%CVE-2020-37250HIGHTFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2020-37251HIGHRealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2020-36933HIGHIPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service PathEPSS 0.2%CVE-2025-12247HIGHHasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search pathEPSS 0.2%CVE-2021-47804HIGHWise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service PathEPSS 0.2%CVE-2024-4461HIGHUnquoted path or search item vulnerability in SugarSyncEPSS 0.2%CVE-2023-22841MEDIUMUnquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(EPSS 0.2%CVE-2019-25309HIGHZilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service PathEPSS 0.2%CVE-2025-43993HIGHDell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or EPSS 0.2%CVE-2019-25307HIGHWorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service PathEPSS 0.2%CVE-2019-25306HIGHBlackMoon FTP Server 3.1.2.1731 - 'BMFTP-RELEASE' Unquoted Serive PathEPSS 0.2%CVE-2025-64151HIGHMultiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write EPSS 0.2%CVE-2025-57699HIGHWestern Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user wEPSS 0.2%