Falhas do tipo CWE-470

131 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2025-63690CRITICALIn pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management moduEPSS 1.1%CVE-2019-3834MEDIUMIt was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate EPSS 1.0%CVE-2020-7857HIGHA vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficEPSS 1.0%CVE-2026-44795HIGHSpinnaker: Non-safe yaml deserialization allowing RCE when using specific typesEPSS 1.0%CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2025-68455HIGHCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.0%CVE-2024-6096HIGHUnsafe Deserialization VulnerabilityEPSS 0.9%CVE-2026-63317MEDIUMApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XMLEPSS 0.9%CVE-2024-8015CRITICALTelerik Report Server Insecure Type ResolutionEPSS 0.8%CVE-2026-55107CRITICALKobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)EPSS 0.8%CVE-2026-55559CRITICALYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)EPSS 0.8%CVE-2025-12967HIGHAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticateEPSS 0.8%CVE-2026-6020HIGHShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIEPSS 0.8%CVE-2026-17593HIGHNexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationEPSS 0.8%CVE-2026-41871CRITICALApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2026-13181HIGHRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.7%CVE-2025-34393CRITICALBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEEPSS 0.7%CVE-2026-42027CRITICALApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderEPSS 0.7%CVE-2026-116692CRITICALMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesEPSS 0.7%CVE-2026-115886MEDIUMMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsEPSS 0.7%