Weaknesses of type CWE-1284

325 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2025-59820MEDIUMIn KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.EPSS 0.2%CVE-2024-0111MEDIUMNVIDIA CUDA Toolkit contains a vulnerability in command 'cuobjdump' where a user may cause a crash or produce incorrect output by passing a EPSS 0.2%CVE-2026-19518MEDIUMImproper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.EPSS 0.2%CVE-2026-19517MEDIUMImproper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open SoEPSS 0.2%CVE-2024-8000MEDIUMOn affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restarEPSS 0.2%CVE-2024-53879LOWNVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a maEPSS 0.2%CVE-2026-59930MEDIUMMistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` contentEPSS 0.2%CVE-2025-68383MEDIUMFilebeat Improper Validation of Specified Index, Position, or Offset in InputEPSS 0.2%CVE-2024-45351HIGHGame center application has code execution VulnerabilityEPSS 0.2%CVE-2025-41100MEDIUMIncorrect authentication in ParkingDoorEPSS 0.2%CVE-2025-3756HIGHDenial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850EPSS 0.2%CVE-2025-48507HIGHThe security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors accesEPSS 0.2%CVE-2025-11743HIGHRockwell Automation CompactLogix® 5370 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-59997MEDIUMinternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-lEPSS 0.2%CVE-2023-20582MEDIUMImproper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults EPSS 0.2%CVE-2024-3185MEDIUMRapid7 Insight Agent Sensitive Key Exposed To Local UsersEPSS 0.2%CVE-2026-2403MEDIUMCWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting loEPSS 0.2%CVE-2022-20491HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.2%CVE-2026-6915MEDIUMFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeEPSS 0.2%CVE-2023-20581LOWImproper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory intEPSS 0.2%