Falhas do tipo CWE-706

122 resultados

Resolução incorreta de nome ou referência

A aplicação resolve um nome ou referência (variável, função, arquivo, objeto) para um alvo errado, geralmente por ambiguidade ou falta de qualificação explícita. Isso permite que um atacante substitua o recurso esperado por outro malicioso, causando execução não autorizada, bypass de validação ou exposição de dados.

Exemplo

Um programa importa uma função de uma biblioteca sem especificar o namespace completo. Um atacante coloca uma função de mesmo nome em um diretório anterior no path de busca, fazendo o programa carregar a versão maliciosa em vez da legítima. Resultado: execução de código arbitrário.

Como mitigar

Use sempre referências qualificadas explícitas (namespaces, caminhos absolutos, imports nomeados). Configure e valide o escopo de resolução (PATH, PYTHONPATH, etc.) e implemente listas de permissão para recursos críticos.

CVE-2026-78942MEDIUMIncorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via cEPSS 0.3%CVE-2026-41354MEDIUMOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe KeysEPSS 0.3%CVE-2022-28198MEDIUMNVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the syEPSS 0.3%CVE-2026-95275MEDIUMIncorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy EPSS 0.3%CVE-2026-54282LOWStarlette: Unvalidated request path concatenated into authority poisons request.url.hostnameEPSS 0.3%CVE-2026-10696HIGHUse of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet communiEPSS 0.3%CVE-2026-106409HIGHIncorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromEPSS 0.3%CVE-2026-41402LOWOpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope BypassEPSS 0.3%CVE-2026-119266HIGHIncorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2026-14288LOWUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.3%CVE-2026-33732MEDIUMsrvx is vulnerable to middleware bypass via absolute URI in request lineEPSS 0.3%CVE-2026-35635MEDIUMOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology ChatEPSS 0.3%CVE-2026-118309CRITICALIncorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social enginEPSS 0.3%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-33490LOWh3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching RoutesEPSS 0.2%CVE-2024-45305LOWgix-path uses local config across repos when it is the highest scopeEPSS 0.2%CVE-2024-55058MEDIUMAn insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerabiliEPSS 0.2%CVE-2026-87562MEDIUMIncorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially sEPSS 0.2%CVE-2026-45306MEDIUMpyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryEPSS 0.2%CVE-2026-106325MEDIUMIncorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leEPSS 0.2%