Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-6915MEDIUMFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeEPSS 0.2%CVE-2023-20581LOWImproper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory intEPSS 0.2%CVE-2026-107429MEDIUMWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerabilityEPSS 0.2%CVE-2023-20515MEDIUMImproper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leadingEPSS 0.2%CVE-2026-91041HIGHFileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT imageEPSS 0.2%CVE-2024-53922MEDIUMAn issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length checEPSS 0.2%CVE-2026-45201HIGHGPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memoryEPSS 0.2%CVE-2026-85201MEDIUMIn Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf mEPSS 0.2%CVE-2026-40272HIGHVulnerability in the QNX libtraceparser Impacts QNX Software Development PlatformEPSS 0.2%CVE-2026-115906MEDIUMzip: AES Entry HMAC Authentication Bypass on Premature EOFEPSS 0.2%CVE-2026-55392MEDIUMNILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_sizeEPSS 0.2%CVE-2023-31331LOWImproper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stacEPSS 0.2%CVE-2023-31304LOWImproper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe® lanEPSS 0.2%CVE-2026-33972—In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.EPSS 0.1%CVE-2026-57062LOWCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is suppEPSS 0.1%CVE-2022-4989HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acceEPSS 0.1%CVE-2026-94024MEDIUMModule Manager object lookup validates one byte of a module's search nameEPSS 0.1%CVE-2023-31310MEDIUMImproper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tEPSS 0.1%CVE-2026-48176—A memory corruption vulnerability caused by improper validation of messagesEPSS 0.1%CVE-2023-20508MEDIUMImproper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bEPSS 0.1%