Falhas do tipo CWE-183

44 resultados

Lista permissiva de entradas permitidas

A aplicação usa uma lista de entradas 'permitidas' tão genérica ou mal configurada que acaba aceitando dados maliciosos. O problema é quando a whitelist é definida com padrões muito amplos (ex: aceitar qualquer string com letras) ou incompletos, deixando brecha para bypass de validação e injeção de payloads perigosos.

Exemplo

Um sistema de upload aceita 'arquivos de imagem' baseado apenas na extensão .jpg, mas um atacante envia um arquivo .jpg que contém código executável. Ou um campo de CPF aceita 'números' via regex /[0-9]+/, permitindo valores com 20 dígitos em vez de exatamente 11.

Como mitigar

Defina whitelists específicas e restritivas: listar exatamente o que é válido (não confiar em negação de padrões ruins). Para uploads, valide tipo MIME real do arquivo além da extensão. Para formatos estruturados (CPF, email), use regex ou parsers precisos que rejeitam tudo fora da especificação exata.

CVE-2020-25696—A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6EPSS 2.6%CVE-2026-21915HIGHJSI Virtual Lightweight Collector: Shell escape allows privilege escalation to rootEPSS 2.2%CVE-2020-1694—A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw reEPSS 1.6%CVE-2024-1654HIGHUnauthorized write operations in PaperCut NG/MFEPSS 1.3%CVE-2023-4399MEDIUMGrafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows adEPSS 1.1%CVE-2021-34787MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass VulnerabilityEPSS 1.0%CVE-2021-40128MEDIUMCisco Webex Meetings Email Content Injection VulnerabilityEPSS 1.0%CVE-2023-7250MEDIUMIperf3: possible denial of serviceEPSS 0.9%CVE-2026-29514HIGHNetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixinEPSS 0.8%CVE-2025-59457HIGHIn JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on WindowsEPSS 0.8%CVE-2025-53762HIGHMicrosoft Purview Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-23158MEDIUMWyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard priviEPSS 0.7%CVE-2026-42043HIGHAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0EPSS 0.7%CVE-2026-3490CRITICALpicklescan - Universal Blocklist Bypass via pkgutil.resolve_nameEPSS 0.6%CVE-2025-24349HIGHA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) aEPSS 0.6%CVE-2026-46391HIGHHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apisEPSS 0.5%CVE-2022-42469MEDIUMA permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW EPSS 0.4%CVE-2022-34450MEDIUM PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially EPSS 0.4%CVE-2026-54316MEDIUMClaude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchEPSS 0.4%CVE-2026-40899HIGHDataEase has an Arbitrary File Read VulnerabilityEPSS 0.4%