Falhas do tipo CWE-428

358 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2021-47780HIGHMacro Expert 4.7 - Unquoted Service PathEPSS 0.2%CVE-2019-25267HIGHWing FTP Server 6.0.7 - Unquoted Service PathEPSS 0.2%CVE-2024-1618HIGHUnquoted item or search path vulnerability in Faronics Deep Freeze Server StandardEPSS 0.2%CVE-2022-50900HIGHWondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service PathEPSS 0.2%CVE-2024-25552HIGHWiesemann & Theis: Multiple products prone to unquoted search pathEPSS 0.2%CVE-2020-36930HIGHSysGauge 7.9.18 - ' SysGauge Server' Unquoted Service PathEPSS 0.2%CVE-2020-36927HIGHDiskPulse 13.6.14 - Unquoted Service PathEPSS 0.2%CVE-2023-3438MEDIUM An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). TEPSS 0.2%CVE-2021-47806HIGHDup Scout 13.5.28 - 'Multiple' Unquoted Service PathEPSS 0.2%CVE-2021-47805HIGHDisk Savvy 13.6.14 - 'Multiple' Unquoted Service PathEPSS 0.2%CVE-2021-47767HIGH10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service PathEPSS 0.2%CVE-2023-53965HIGHSOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service PathEPSS 0.2%CVE-2025-54081MEDIUMSunshineService Has Unquoted Service Path That Allows Local SYSTEM Code ExecutionEPSS 0.2%CVE-2024-58315HIGHTosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service PathEPSS 0.2%CVE-2022-0883HIGHWindows Unquoted/Trusted Service PathsEPSS 0.2%CVE-2022-50923HIGHCobian Backup 0.9 - Unquoted Service PathEPSS 0.2%CVE-2021-47810HIGHWibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47790HIGHActive WebCam 11.5 - Unquoted Service PathEPSS 0.2%CVE-2025-0035HIGHUnquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbiEPSS 0.2%CVE-2022-50917HIGHProtonVPN 1.26.0 - Unquoted Service PathEPSS 0.2%