Falhas do tipo CWE-477

16 resultados

Uso de função obsoleta

Ocorre quando o código chama funções que foram marcadas como obsoletas ou descontinuadas pela linguagem, biblioteca ou padrão de segurança. Essas funções geralmente foram substituídas por alternativas mais seguras ou robustas, e seu uso mantém vulnerabilidades conhecidas que já foram corrigidas em versões modernas.

Exemplo

Um desenvolvedor usa strcpy() em C para copiar strings, ignorando que a função não valida limites de buffer. A linguagem oferece strncpy() ou strlcpy() há décadas, mas o código legado persiste com a função insegura, abrindo brecha para buffer overflow.

Como mitigar

Substitua funções obsoletas pelas alternativas recomendadas (strcpy → strncpy/strlcpy, sprintf → snprintf, gets → fgets). Mantenha compiladores com warnings habilitados e use análise estática para detectar deprecações antes de produção.

CVE-2025-49213CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 9.8%CVE-2025-49212CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 9.8%CVE-2018-17890—NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbEPSS 3.3%CVE-2025-49220CRITICALAn insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execEPSS 2.0%CVE-2019-18251—In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of TeamviewEPSS 1.7%CVE-2025-49219CRITICALAn insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code exeEPSS 1.4%CVE-2025-49217CRITICALAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeEPSS 1.1%CVE-2020-6978—In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.EPSS 0.8%CVE-2025-49214HIGHAn insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code exEPSS 0.8%CVE-2022-1384MEDIUMAuthorized users are allowed to install old plugin versions from the MarketplaceEPSS 0.6%CVE-2023-23451CRITICALThe Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE4EPSS 0.6%CVE-2025-49216CRITICALAn authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as EPSS 0.5%CVE-2019-10988—In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 UltrasEPSS 0.3%CVE-2019-10968—Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabEPSS 0.3%CVE-2026-1693MEDIUMUse of vulnerable Resource Owner Password Credentials flowEPSS 0.3%CVE-2023-28829LOWA vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7EPSS 0.3%