Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-2597HIGHCrypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()EPSS 0.3%CVE-2023-27941MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, EPSS 0.3%CVE-2025-5808HIGHAuthentication Bypass vulnerability discovered in the OpenText™ Self-Service Password ResetEPSS 0.3%CVE-2025-12385HIGHImproper validation of <img> tag size in Text component parserEPSS 0.3%CVE-2025-36428MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-43881MEDIUMImproper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a deniEPSS 0.3%CVE-2024-23593MEDIUM A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from EPSS 0.3%CVE-2025-32689HIGHWordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerabilityEPSS 0.3%CVE-2026-1352MEDIUMIBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined indexEPSS 0.3%CVE-2026-70378HIGHimagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable PanicEPSS 0.3%CVE-2026-40093HIGHnimiq-blockchain is missing a wall-clock upper bound on block timestampsEPSS 0.3%CVE-2025-49292MEDIUMWordPress Profile Builder plugin <= 3.13.8 - Content Spoofing VulnerabilityEPSS 0.3%CVE-2026-9704MEDIUMKeycloak: keycloak: privilege escalation due to oversized subject_token jwtEPSS 0.3%CVE-2024-31957MEDIUMA vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of nativeEPSS 0.3%CVE-2026-26934MEDIUMImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2023-0195LOWNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284, whEPSS 0.3%CVE-2026-112112LOWAn IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matchiEPSS 0.3%CVE-2025-36407MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-13507HIGHTime-series operations may cause internal BSON size limit to be exceedEPSS 0.3%CVE-2026-94645HIGHApache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundEPSS 0.3%