Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2022-47029HIGHAn issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function updatEPSS 0.4%CVE-2026-101952HIGHJunos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabledEPSS 0.4%CVE-2026-31971HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.4%CVE-2026-27384CRITICALWordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2026-19518MEDIUMImproper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.EPSS 0.4%CVE-2026-19517MEDIUMImproper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open SoEPSS 0.4%CVE-2026-55706MEDIUMsppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.EPSS 0.4%CVE-2025-14869HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2025-52534MEDIUMImproper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integritEPSS 0.4%CVE-2026-79376HIGHAn issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers tEPSS 0.4%CVE-2026-66679MEDIUMWordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-57364MEDIUMWordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerabilityEPSS 0.4%CVE-2025-61938HIGHBIG-IP Advanced WAF and ASM bd process vulnerabilityEPSS 0.3%CVE-2026-86133HIGHFireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of ServiceEPSS 0.3%CVE-2026-49218HIGHImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsEPSS 0.3%CVE-2026-82397HIGHTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopEPSS 0.3%CVE-2021-46893—Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.EPSS 0.3%CVE-2026-2474HIGHCrypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()EPSS 0.3%CVE-2026-2597HIGHCrypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()EPSS 0.3%CVE-2025-36178MEDIUMMultiple vulnerabilities in IBM ControllerEPSS 0.3%