Fallos del tipo CWE-913

69 resultados

Controle inadequado de recursos de código gerenciado dinamicamente

É quando a aplicação carrega, executa ou modifica código dinamicamente (via eval, reflection, desserialização, plugins) sem validação ou controle suficiente. Um atacante pode injetar código malicioso que será executado com os mesmos privilégios da aplicação, contornando controles de segurança.

Ejemplo

Uma aplicação Java que desserializa dados untrusted diretamente com ObjectInputStream permite ao atacante executar código arbitrário; ou um sistema que usa eval() em strings enviadas pelo usuário sem validação prévia.

Cómo mitigar

Nunca use eval() ou equivalentes com entrada untrusted. Se precisar executar código dinamicamente, use listas brancas estritas, sandboxes de execução ou frameworks que isolem o código dinâmico. Valide e sanitize serialização com bibliotecas seguras (ex: Java com Deserialization filters).

CVE-2025-68613CRITICALn8n Vulnerable to Remote Code Execution via Expression InjectionEPSS 97.9%KEVCVE-2023-50386HIGHApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsEPSS 83.8%CVE-2023-29017CRITICALvm2 Sandbox Escape vulnerabilityEPSS 63.2%CVE-2022-36067CRITICALvm2 vulnerable to Sandbox Escape before v3.9.11EPSS 47.9%CVE-2023-6184MEDIUMCross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site ScriptingEPSS 46.6%CVE-2026-34156CRITICALNocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script NodeEPSS 36.5%CVE-2024-7297HIGHLangflow Privilege EscalationEPSS 21.3%CVE-2025-66398CRITICALSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)EPSS 18.2%CVE-2017-3202—The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code controlEPSS 8.3%CVE-2017-3200—The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code controlEPSS 6.2%CVE-2024-27135HIGHApache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionEPSS 6.0%CVE-2023-29199CRITICALvm2 Sandbox escape vulnerabilityEPSS 3.9%CVE-2025-13659HIGHImproper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticEPSS 1.9%CVE-2026-47210CRITICALvm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassEPSS 1.8%CVE-2020-3419MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Ghost Join VulnerabilityEPSS 1.7%CVE-2022-40635MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.3%CVE-2022-40634MEDIUMImproper Control of Dynamically-Managed Code Resources in Crafter StudioEPSS 1.3%CVE-2019-1617HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityEPSS 1.3%CVE-2026-22709CRITICALvm2 has a Sandbox EscapeEPSS 1.2%CVE-2026-25049CRITICALn8n Has an Expression Escape Vulnerability Leading to RCEEPSS 1.2%