Falhas do tipo CWE-706

122 resultados

Resolução incorreta de nome ou referência

A aplicação resolve um nome ou referência (variável, função, arquivo, objeto) para um alvo errado, geralmente por ambiguidade ou falta de qualificação explícita. Isso permite que um atacante substitua o recurso esperado por outro malicioso, causando execução não autorizada, bypass de validação ou exposição de dados.

Exemplo

Um programa importa uma função de uma biblioteca sem especificar o namespace completo. Um atacante coloca uma função de mesmo nome em um diretório anterior no path de busca, fazendo o programa carregar a versão maliciosa em vez da legítima. Resultado: execução de código arbitrário.

Como mitigar

Use sempre referências qualificadas explícitas (namespaces, caminhos absolutos, imports nomeados). Configure e valide o escopo de resolução (PATH, PYTHONPATH, etc.) e implemente listas de permissão para recursos críticos.

CVE-2022-30258CRITICALAn issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domainEPSS 0.7%CVE-2024-57785MEDIUMZenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.EPSS 0.7%CVE-2024-27295HIGHDirectus MySQL accent insensitive email matchingEPSS 0.7%CVE-2024-52515MEDIUMNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsEPSS 0.7%CVE-2021-37215MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4EPSS 0.7%CVE-2023-42451HIGHMastodon Invalid Domain Name Normalization vulnerabilityEPSS 0.7%CVE-2021-37212MEDIUMLarvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1EPSS 0.6%CVE-2026-67602CRITICALphpIPAM < 1.8.2 Authentication Bypass via REST API Object CacheEPSS 0.6%CVE-2025-58362HIGHHono contains a flaw in URL path parsing, potentially leading to path confusionEPSS 0.6%CVE-2026-62685HIGHFile Browser: Colliding username normalization gives two users the same home directoryEPSS 0.6%CVE-2023-28628MEDIUM`authority-regex` returns the wrong authority in lambdaisland/uriEPSS 0.5%CVE-2026-107822MEDIUMMariaDB: database privilege escalation via user / role name collision in the acl cacheEPSS 0.5%CVE-2026-62190HIGHOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperEPSS 0.5%CVE-2026-78985CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeringEPSS 0.5%CVE-2026-87547CRITICALIncorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeringEPSS 0.5%CVE-2026-25890HIGHFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLEPSS 0.5%CVE-2026-13372HIGHIncorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.EPSS 0.5%CVE-2026-118938HIGHFickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysisEPSS 0.5%CVE-2026-87613CRITICALIncorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrEPSS 0.5%CVE-2026-92951CRITICALvm2 before 3.11.7 Module Allowlist Bypass via Custom ResolverEPSS 0.5%