Weaknesses of type CWE-1284

325 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2022-20543LOWIn multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service wEPSS 0.2%CVE-2023-20515MEDIUMImproper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leadingEPSS 0.2%CVE-2024-21953MEDIUMImproper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integriEPSS 0.2%CVE-2024-53922MEDIUMAn issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length checEPSS 0.2%CVE-2026-55392MEDIUMNILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_sizeEPSS 0.2%CVE-2023-31331LOWImproper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stacEPSS 0.2%CVE-2023-31304LOWImproper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe® lanEPSS 0.2%CVE-2026-57053MEDIUMGNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicoEPSS 0.1%CVE-2022-4989HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acceEPSS 0.1%CVE-2026-57062LOWCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is suppEPSS 0.1%CVE-2026-87735MEDIUMAn issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message durinEPSS 0.1%CVE-2023-31310MEDIUMImproper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tEPSS 0.1%CVE-2023-20508MEDIUMImproper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bEPSS 0.1%CVE-2024-36346MEDIUMImproper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input daEPSS 0.1%CVE-2026-82734LOWNon-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.DecimalEPSS 0.1%CVE-2022-4990HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypaEPSS 0.1%CVE-2026-46033HIGHcrypto: authencesn - reject short ahash digests during instance creationEPSS 0.1%CVE-2026-82752MEDIUMAsh string length constraints count graphemes, so a combining-mark string of any size passes max_lengthEPSS 0.1%CVE-2026-53720MEDIUMpymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too smallEPSS 0.1%CVE-2025-0038MEDIUMIn AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow accesEPSS 0.1%