Falhas do tipo CWE-706

122 resultados

Resolução incorreta de nome ou referência

A aplicação resolve um nome ou referência (variável, função, arquivo, objeto) para um alvo errado, geralmente por ambiguidade ou falta de qualificação explícita. Isso permite que um atacante substitua o recurso esperado por outro malicioso, causando execução não autorizada, bypass de validação ou exposição de dados.

Exemplo

Um programa importa uma função de uma biblioteca sem especificar o namespace completo. Um atacante coloca uma função de mesmo nome em um diretório anterior no path de busca, fazendo o programa carregar a versão maliciosa em vez da legítima. Resultado: execução de código arbitrário.

Como mitigar

Use sempre referências qualificadas explícitas (namespaces, caminhos absolutos, imports nomeados). Configure e valide o escopo de resolução (PATH, PYTHONPATH, etc.) e implemente listas de permissão para recursos críticos.

CVE-2026-79070MEDIUMIncorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a EPSS 0.3%CVE-2026-79273MEDIUMIncorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypEPSS 0.3%CVE-2026-79264MEDIUMIncorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via EPSS 0.3%CVE-2025-12506LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-76039MEDIUMIncorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social enEPSS 0.3%CVE-2026-61844HIGHFileRise: Folder Metadata Filename Collisions Bypass "read_own" IsolationEPSS 0.3%CVE-2026-95334HIGHIncorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rendeEPSS 0.3%CVE-2025-29914MEDIUMOWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`EPSS 0.3%CVE-2026-121133HIGHIncorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-88621LOWOneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticatedEPSS 0.3%CVE-2026-25067MEDIUMSmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path CoercionEPSS 0.3%CVE-2026-87720HIGHIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewEPSS 0.3%CVE-2026-106181MEDIUMIncorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-106230MEDIUMIncorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromiseEPSS 0.3%CVE-2026-79103LOWIncorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer EPSS 0.3%CVE-2026-25825LOWAn issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set tEPSS 0.3%CVE-2026-30856MEDIUMWeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt InjectionEPSS 0.3%CVE-2026-110156HIGHIncorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromisedEPSS 0.3%CVE-2026-106308HIGHIncorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging socialEPSS 0.3%CVE-2026-106274HIGHIncorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engiEPSS 0.3%