Falhas do tipo CWE-706

122 resultados

Resolução incorreta de nome ou referência

A aplicação resolve um nome ou referência (variável, função, arquivo, objeto) para um alvo errado, geralmente por ambiguidade ou falta de qualificação explícita. Isso permite que um atacante substitua o recurso esperado por outro malicioso, causando execução não autorizada, bypass de validação ou exposição de dados.

Exemplo

Um programa importa uma função de uma biblioteca sem especificar o namespace completo. Um atacante coloca uma função de mesmo nome em um diretório anterior no path de busca, fazendo o programa carregar a versão maliciosa em vez da legítima. Resultado: execução de código arbitrário.

Como mitigar

Use sempre referências qualificadas explícitas (namespaces, caminhos absolutos, imports nomeados). Configure e valide o escopo de resolução (PATH, PYTHONPATH, etc.) e implemente listas de permissão para recursos críticos.

CVE-2026-119270HIGHIncorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2026-1230MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-119265HIGHIncorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pEPSS 0.2%CVE-2026-112909MEDIUMfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathEPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2026-79254MEDIUMIncorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass systeEPSS 0.2%CVE-2026-77605HIGHNotepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)EPSS 0.2%CVE-2026-8716MEDIUMUse of Incorrectly-Resolved Name or Reference in GitLabEPSS 0.2%CVE-2026-35358MEDIUMuutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream ReadingEPSS 0.2%CVE-2026-114663HIGHVyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default ArgumentsEPSS 0.2%CVE-2026-119675MEDIUMmongorestore may bypass collection guards through a system.buckets prefixEPSS 0.2%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-118314HIGHIncorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineEPSS 0.2%CVE-2025-62378MEDIUMCommandKit exposes incorrect command name in context object for message command aliasesEPSS 0.2%CVE-2026-78359MEDIUMDuplicate Identity / Identity Shadowing across CustomerUser backendsEPSS 0.2%CVE-2026-42254MEDIUMHickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query thatEPSS 0.2%CVE-2026-41131MEDIUMOpenFGA has Improper Policy EnforcementEPSS 0.1%CVE-2024-51746LOWUse of incorrect Rekor entries during verification in gitsignEPSS 0.1%CVE-2026-91727HIGHIncorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised EPSS 0.1%CVE-2026-93375HIGHIncorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execEPSS 0.1%