Falhas do tipo CWE-840

99 resultados

Falhas na Lógica de Negócio

É quando o código implementa corretamente as instruções, mas essas instruções não refletem corretamente as regras de negócio pretendidas. O atacante explora desvios entre o que o sistema *deveria* fazer e o que ele realmente faz para contornar controles, contabilidade ou autorização.

Exemplo

Um carrinho de compras que permite aplica cupom de desconto múltiplas vezes quando deveria aceitar apenas uma; ou um sistema de transferência bancária que não valida se a conta de destino pertence ao mesmo titular, permitindo movimentações não autorizadas entre contas.

Como mitigar

Valide regras de negócio no backend (nunca confie no frontend). Implemente testes que cobram cenários de abuso: cupons reutilizados, limites ultrapassados, estados inválidos. Mantenha auditoria de operações sensíveis e revise regularmente a lógica com especialistas de negócio.

CVE-2024-32999MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2024-4046MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-41965MEDIUMUse-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-58558HIGHPermission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2024-39671CRITICALAccess control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58043HIGHPermission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2026-41966MEDIUMPermission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confEPSS 0.1%CVE-2024-42034MEDIUMLaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2023-7271MEDIUMPrivilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2025-54606HIGHStatus verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability EPSS 0.1%CVE-2025-54611HIGHEXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58046MEDIUMPermission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%CVE-2025-58289MEDIUMVulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41971MEDIUMPermission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service coEPSS 0.1%CVE-2026-41968MEDIUMPermission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%CVE-2026-28550MEDIUMRace condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41973MEDIUMPermission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41961MEDIUMPermission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41967MEDIUMPermission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%