Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%CVE-2024-8558MEDIUMSourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in inputEPSS 0.6%CVE-2023-25731HIGHDue to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwriteEPSS 0.6%CVE-2026-103501CRITICALApache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketchEPSS 0.6%CVE-2025-14513HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.5%CVE-2026-54092MEDIUMFile Browser: DoS Vulnerability on Public Login APIEPSS 0.5%CVE-2024-52901MEDIUMIBM InfoSphere Information Server denial of serviceEPSS 0.5%CVE-2026-78010HIGHFireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of ServiceEPSS 0.5%CVE-2025-2826LOWn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.EPSS 0.5%CVE-2023-54337MEDIUMSysax Multi Server 6.95 - 'Password' Denial of Service (PoC)EPSS 0.5%CVE-2022-2845HIGHImproper Validation of Specified Quantity in Input in vim/vimEPSS 0.5%CVE-2025-2256HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%CVE-2026-57623CRITICALWordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityEPSS 0.5%CVE-2026-82751HIGHUnbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioningEPSS 0.5%CVE-2026-82750HIGHUnbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationEPSS 0.5%CVE-2025-70071MEDIUMAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()EPSS 0.5%CVE-2026-8813HIGHThis affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled recEPSS 0.5%CVE-2026-81779CRITICALWordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerabilityEPSS 0.5%CVE-2024-30527HIGHWordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerabilityEPSS 0.5%