Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-73436MEDIUMSecurity Advisory 0171EPSS 0.3%CVE-2025-36423MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2026-105754MEDIUMvLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresEPSS 0.3%CVE-2026-101985HIGHJunos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabledEPSS 0.3%CVE-2026-102033HIGHJunos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabledEPSS 0.3%CVE-2026-101987HIGHJunos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is usedEPSS 0.3%CVE-2026-57019HIGHJunos OS: MX Series: Specific traffic causes an FPC to resetEPSS 0.3%CVE-2025-10933MEDIUMSilicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds readEPSS 0.3%CVE-2024-30516HIGHWordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerabilityEPSS 0.3%CVE-2026-107434MEDIUMWordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2024-3036MEDIUMCommunication DoS vulnerabilityEPSS 0.3%CVE-2026-30573HIGHA Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is located in the add-saleEPSS 0.3%CVE-2026-45441HIGHWordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerabilityEPSS 0.3%CVE-2026-44826HIGHVvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totalsEPSS 0.3%CVE-2025-36094MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.EPSS 0.3%CVE-2026-102067HIGHJunos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is usedEPSS 0.3%CVE-2026-49078HIGHWordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerabilityEPSS 0.3%CVE-2026-101974HIGHJunos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is usedEPSS 0.3%CVE-2026-94395HIGHStack-based buffer overflow in SafeNet Authentication Client SIS token engineEPSS 0.3%CVE-2024-48290MEDIUMAn issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) vEPSS 0.2%