Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2021-47822HIGHDiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47803HIGHiFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service PathEPSS 0.2%CVE-2020-37055HIGHSpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service PathEPSS 0.2%CVE-2024-2747HIGHCWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user reEPSS 0.2%CVE-2019-25272HIGHTexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service PathEPSS 0.2%CVE-2021-47829HIGHDHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service PathEPSS 0.2%CVE-2019-25309HIGHZilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service PathEPSS 0.2%CVE-2021-47823HIGHePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service PathEPSS 0.2%CVE-2019-25286HIGH_GCafé 3.0 - 'gbClienService' Unquoted Service PathEPSS 0.2%CVE-2020-37062HIGHDHCP Turbo 4.6.1298- 'DHCP Turbo 4' Unquoted Service PathEPSS 0.2%CVE-2019-25273HIGHEasy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service PathEPSS 0.2%CVE-2020-37037HIGHAVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service PathEPSS 0.2%CVE-2020-37064HIGHEPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service PathEPSS 0.2%CVE-2021-47985HIGHBrother SAPSprint 7.60 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2024-5963MEDIUMAn unquoted executable path exists in Hitachi Device ManagerEPSS 0.2%CVE-2016-20091HIGHWindows Firewall Control 4.8.6.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2021-47882HIGHFreeLAN 2.2 - 'FreeLAN Service' Unquoted Service PathEPSS 0.2%CVE-2024-31201MEDIUMA “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenariosEPSS 0.2%CVE-2026-24466HIGHProducts provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows serviceEPSS 0.2%CVE-2026-77827HIGHMaono Link local privilege escalationEPSS 0.2%