Falhas do tipo CWE-840

108 resultados

Falhas na Lógica de Negócio

É quando o código implementa corretamente as instruções, mas essas instruções não refletem corretamente as regras de negócio pretendidas. O atacante explora desvios entre o que o sistema *deveria* fazer e o que ele realmente faz para contornar controles, contabilidade ou autorização.

Exemplo

Um carrinho de compras que permite aplica cupom de desconto múltiplas vezes quando deveria aceitar apenas uma; ou um sistema de transferência bancária que não valida se a conta de destino pertence ao mesmo titular, permitindo movimentações não autorizadas entre contas.

Como mitigar

Valide regras de negócio no backend (nunca confie no frontend). Implemente testes que cobram cenários de abuso: cupons reutilizados, limites ultrapassados, estados inválidos. Mantenha auditoria de operações sensíveis e revise regularmente a lógica com especialistas de negócio.

CVE-2026-105573MEDIUMnewbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic errorEPSS 0.2%CVE-2026-116461MEDIUMOmega Solution Restro POS sale-invoice logic errorEPSS 0.2%CVE-2026-11465LOWsongquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic errorEPSS 0.2%CVE-2026-4547MEDIUMmickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic errorEPSS 0.2%CVE-2024-51523HIGHInformation management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidenEPSS 0.2%CVE-2026-108789MEDIUMdeepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflowEPSS 0.2%CVE-2024-54098HIGHService logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service inteEPSS 0.2%CVE-2024-56449MEDIUMPrivilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.2%CVE-2024-32999MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2024-4046MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-41965MEDIUMUse-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-58558HIGHPermission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2024-39671CRITICALAccess control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58043HIGHPermission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2026-41966MEDIUMPermission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confEPSS 0.1%CVE-2025-54606HIGHStatus verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability EPSS 0.1%CVE-2024-42034MEDIUMLaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-54611HIGHEXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2023-7271MEDIUMPrivilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2024-58046MEDIUMPermission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%