Falhas do tipo CWE-428

356 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2021-47896HIGHPDFCOMPLETE Corporate Edition 4.1.45 - 'pdfcDispatcher' Unquoted Service PathEPSS 0.1%CVE-2021-47890HIGHLogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service PathEPSS 0.1%CVE-2026-5789HIGHSearch path without quotes in CivetWebEPSS 0.1%CVE-2023-53954HIGHActFax 10.10 Unquoted Path Services Privilege Escalation VulnerabilityEPSS 0.1%CVE-2021-47889HIGHSoftros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service PathEPSS 0.1%CVE-2020-36937HIGHMEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service PathEPSS 0.1%CVE-2020-36936HIGHMagic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service PathEPSS 0.1%CVE-2025-1984MEDIUMLocal Privilege Escalation on Xerox® Desktop Print Experience® v8.5EPSS 0.1%CVE-2021-47898HIGHEpson USB Display 1.6.0.0 Unquoted Service Path VulnerabilityEPSS 0.1%CVE-2025-13433HIGHMuse Group MuseHub Windows Service Muse.Updater.exe unquoted search pathEPSS 0.1%CVE-2020-37030HIGHOutline Service 1.3.3 - 'Outline Service ' Unquoted Service PathEPSS 0.1%CVE-2020-36980HIGHSAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service PathEPSS 0.1%CVE-2026-66839HIGHNetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An auEPSS 0.1%CVE-2019-25304HIGHIntelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service PathEPSS 0.1%CVE-2019-25266HIGHWondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service PathEPSS 0.1%CVE-2019-25293HIGHBlue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service PathEPSS 0.1%CVE-2019-25302HIGHAcer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service PathEPSS 0.1%CVE-2021-47762HIGHHTTPDebuggerPro 9.11 - Unquoted Service PathEPSS 0.1%CVE-2019-25345HIGHRTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service PathEPSS 0.1%CVE-2026-25866HIGHMobaXterm < 26.1 Notepad++ Unquoted Service PathEPSS 0.1%