Falhas do tipo CWE-696

42 resultados

Ordem incorreta de operações

Ocorre quando o código executa operações em sequência errada, violando pré-condições ou causando estados inválidos. Por exemplo, validar um dado depois de usá-lo, ou liberar um recurso antes de garantir que ninguém mais o está acessando. O resultado é comportamento imprevisível, bypasses de segurança ou corrupção de dados.

Exemplo

Um banco de dados deleta um registro e só depois verifica se o usuário tinha permissão para deletá-lo. Nesse intervalo, outro processo pode tentar acessar o registro inexistente, ou a autorização é checada tarde demais para impedir o dano.

Como mitigar

Realize checks de validação e autorização ANTES de qualquer operação crítica. Use padrões transacionais ou locks para garantir atomicidade. Documente explicitamente a sequência esperada de operações e revise fluxos em code review focando em dependências entre passos.

CVE-2024-30410MEDIUMJunos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.EPSS 0.4%CVE-2024-30389MEDIUMJunos OS: EX4300 Series: Firewall filter not blocking egress trafficEPSS 0.4%CVE-2026-43002MEDIUMAn issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before aEPSS 0.4%CVE-2026-65100MEDIUMApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeEPSS 0.4%CVE-2026-45033HIGHGitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorEPSS 0.4%CVE-2026-35386LOWIn OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario wEPSS 0.3%CVE-2026-67217MEDIUMcJSON JSON Patch Non-Atomic Application Destroys Data Before ValidationEPSS 0.3%CVE-2026-14169HIGHads-tec Industrial IT: Account lockout via non-atomic user creationEPSS 0.3%CVE-2023-23576MEDIUM Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than inteEPSS 0.3%CVE-2026-68930MEDIUMRussh: Channel-scoped server callbacks can be reached without an open channelEPSS 0.3%CVE-2025-20012MEDIUMIncorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information discloEPSS 0.3%CVE-2026-35636HIGHOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId ResolutionEPSS 0.3%CVE-2026-73446HIGHSecurity Advisory 0160EPSS 0.2%CVE-2026-35637MEDIUMOpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DMEPSS 0.2%CVE-2024-45157MEDIUMAn issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously EPSS 0.2%CVE-2024-24853HIGHIncorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a priviEPSS 0.2%CVE-2026-33305MEDIUMOpenEMR has Authorization Bypass in FaxSMS AppDispatch ConstructorEPSS 0.2%CVE-2021-47688MEDIUMIn WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functionality because a file cEPSS 0.2%CVE-2026-59305LOWPartition interceptor may be improperly added while sending messageEPSS 0.2%CVE-2026-49317LOWIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at bootEPSS 0.1%