Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2023-20508MEDIUMImproper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bEPSS 0.1%CVE-2026-46033HIGHcrypto: authencesn - reject short ahash digests during instance creationEPSS 0.1%CVE-2024-36346MEDIUMImproper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input daEPSS 0.1%CVE-2025-54515LOWThe Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination InterfaEPSS 0.1%CVE-2022-4990HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypaEPSS 0.1%CVE-2026-102514HIGHOut-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archiveEPSS 0.1%CVE-2025-0038MEDIUMIn AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow accesEPSS 0.1%CVE-2026-70659HIGHstable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor nameEPSS 0.1%CVE-2026-118782HIGHForge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countEPSS 0.1%CVE-2022-20488HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.1%CVE-2026-102730HIGHOut-of-bounds Write via NAND Metadata Parsing at Mount in LevelXEPSS 0.1%CVE-2023-20708MEDIUMIn keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with SEPSS 0.1%CVE-2026-6839MEDIUMImproper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor iEPSS 0.1%CVE-2025-11568MEDIUMLuksmeta: data corruption when handling luks1 partitions with luksmetaEPSS 0.1%CVE-2025-66660LOWInsufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cEPSS 0.1%CVE-2026-0428LOWInsufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGSEPSS 0.1%CVE-2026-107565MEDIUMLuksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruptionEPSS 0.1%CVE-2021-0934MEDIUMIn findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial oEPSS 0.1%CVE-2023-20707MEDIUMIn ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2023-20709MEDIUMIn keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with SyEPSS 0.1%