Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2020-37102HIGHAdaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service PathEPSS 0.1%CVE-2020-37098HIGHDisk Sorter Enterprise 12.4.16 - Unquoted Service PathEPSS 0.1%CVE-2020-37020HIGHSonarQube 8.3.1 - Unquoted Service PathEPSS 0.1%CVE-2021-47898HIGHEpson USB Display 1.6.0.0 Unquoted Service Path VulnerabilityEPSS 0.1%CVE-2020-37063HIGHTFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service PathEPSS 0.1%CVE-2020-37061HIGHBOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service PathEPSS 0.1%CVE-2019-25310HIGHActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service PathEPSS 0.1%CVE-2020-36936HIGHMagic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service PathEPSS 0.1%CVE-2020-37016HIGHBarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service PathEPSS 0.1%CVE-2020-37099HIGHDisk Savvy Enterprise 12.3.18 - 'disksvs.exe' Unquoted Service PathEPSS 0.1%CVE-2020-36937HIGHMEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service PathEPSS 0.1%CVE-2021-47889HIGHSoftros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service PathEPSS 0.1%CVE-2025-60320MEDIUMmemoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The EPSS 0.1%CVE-2025-1984MEDIUMLocal Privilege Escalation on Xerox® Desktop Print Experience® v8.5EPSS 0.1%CVE-2020-37017HIGHCodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service PathEPSS 0.1%CVE-2025-57227HIGHAn unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted exEPSS 0.1%CVE-2025-12507HIGHInsecure service configuration – unquoted pathEPSS 0.1%CVE-2026-5789HIGHSearch path without quotes in CivetWebEPSS 0.1%CVE-2023-53954HIGHActFax 10.10 Unquoted Path Services Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-1585HIGHAn unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 may allow a local attaEPSS 0.1%