Falhas do tipo CWE-691

41 resultados

Controle de Fluxo Insuficiente

É quando o código não valida ou não controla adequadamente quais caminhos de execução podem ser seguidos, permitindo que o programa execute instruções indesejadas ou pule validações críticas. Acontece quando faltam verificações de precondições, estado da aplicação ou permissões antes de executar operações sensíveis.

Exemplo

Um sistema de autenticação que verifica a senha, mas não valida se o usuário ainda está ativo ou se sua sessão expirou antes de conceder acesso a dados sensíveis. Ou um aplicativo que executa uma transação financeira sem confirmar se o estado da conta permite tal operação.

Como mitigar

Implemente validações explícitas de estado e permissões em todos os pontos críticos do código; use máquinas de estado para operações sensíveis e realize testes de caminhos de execução alternativos para detectar saltos indevidos no fluxo esperado.

CVE-2021-0157MEDIUMInsufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escEPSS 3.1%CVE-2026-43503HIGHnet: skbuff: propagate shared-frag marker through frag-transfer helpersEPSS 2.0%CVE-2022-20697HIGHCisco IOS and IOS XE Software Web Services Denial of Service VulnerabilityEPSS 1.2%CVE-2026-115893CRITICALWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionEPSS 1.0%CVE-2024-3847CRITICALInsufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policyEPSS 0.9%CVE-2023-5102MEDIUM Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionalitEPSS 0.8%CVE-2023-20559HIGH Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leadEPSS 0.7%CVE-2023-44384MEDIUMDiscourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationEPSS 0.5%CVE-2025-49463MEDIUMZoom Clients for iOS - Insufficient Control Flow ManagementEPSS 0.5%CVE-2025-47774LOWVyper's `slice()` may elide side-effects when output length is 0EPSS 0.5%CVE-2026-20271HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.5%CVE-2026-20276HIGHCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.5%CVE-2025-47285LOWVyper's `concat()` builtin may elide side-effects for zero-length argumentsEPSS 0.5%CVE-2025-51675HIGHAn issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to aEPSS 0.5%CVE-2024-33617HIGHInsufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosureEPSS 0.5%CVE-2024-37158LOWEvmos is missing precompile checksEPSS 0.4%CVE-2025-25774MEDIUMAn issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may causeEPSS 0.4%CVE-2026-79033HIGHInsufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeEPSS 0.4%CVE-2020-12359MEDIUMInsufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable esEPSS 0.3%CVE-2022-46828MEDIUMIn JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.EPSS 0.3%