Falhas do tipo CWE-92

34 resultados

Verificação inadequada de condições

Ocorre quando o código não valida corretamente as condições antes de executar operações críticas, permitindo que estados inválidos ou inesperados passem despercebidos. O desenvolvedor assume que certos pré-requisitos são atendidos, mas não os testa de fato, deixando brechas para lógica de segurança falhar.

Exemplo

Um sistema verifica se o usuário está logado, mas apenas testa uma flag booleana sem validar se o token não expirou ou se a sessão ainda é válida. Um atacante reutiliza um token antigo e consegue acesso indevido porque a condição de 'usuário autenticado' foi verificada de forma incompleta.

Como mitigar

Implemente verificações de condição explícitas e exaustivas: valide todos os pré-requisitos necessários antes de executar operações sensíveis, use assertions ou guardiões de lógica, e não confie em suposições implícitas sobre o estado da aplicação. Testes unitários e de segurança devem cobrir casos onde as condições esperadas não são atendidas.

CVE-2022-43507HIGHImproper buffer restrictions in the Intel(R) QAT Engine for OpenSSL before version 0.6.16 may allow a privileged user to potentially enable EPSS 0.6%CVE-2023-38655MEDIUMImproper buffer restrictions in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentiallEPSS 0.5%CVE-2023-47169LOWImproper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of serEPSS 0.3%CVE-2024-23918HIGHImproper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privilegedEPSS 0.3%CVE-2023-45845MEDIUMImproper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to pEPSS 0.2%CVE-2023-47165MEDIUMImproper conditions check in the Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow an privileged user to potentially enabEPSS 0.2%CVE-2022-41808LOWImproper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to poteEPSS 0.2%CVE-2023-22390MEDIUMImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-22313LOWImproper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable EPSS 0.2%CVE-2022-29262HIGHImproper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of priEPSS 0.2%CVE-2023-27300LOWImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-27307LOWImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-27308MEDIUMImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potenEPSS 0.2%CVE-2023-40220MEDIUMImproper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure viaEPSS 0.2%CVE-2023-25545HIGHImproper buffer restrictions in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalationEPSS 0.2%CVE-2024-21809MEDIUMImproper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated useEPSS 0.2%CVE-2022-29510HIGHImproper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to potenEPSS 0.2%CVE-2023-27504HIGHImproper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.2%CVE-2023-30767MEDIUMImproper buffer restrictions in Intel(R) Optimization for TensorFlow before version 2.13.0 may allow an authenticated user to potentially enEPSS 0.2%CVE-2023-28383MEDIUMImproper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalation of privilege via EPSS 0.2%