Weaknesses of type CWE-1284

324 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2025-14511HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2026-82397HIGHTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopEPSS 0.4%CVE-2025-36427MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-5257MEDIUMPredictable Page Indexing Might Lead to Sensitive Data ExposureEPSS 0.3%CVE-2025-36424MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-61938HIGHBIG-IP Advanced WAF and ASM bd process vulnerabilityEPSS 0.3%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.3%CVE-2026-49218HIGHImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsEPSS 0.3%CVE-2021-46893—Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.EPSS 0.3%CVE-2025-36178MEDIUMMultiple vulnerabilities in IBM ControllerEPSS 0.3%CVE-2026-53540LOWPython-Multipart: Negative Content-Length in parse_form buffers the entire body in memoryEPSS 0.3%CVE-2026-71562MEDIUMhttpc does not bound server-supplied numeric header values before integer conversionEPSS 0.3%CVE-2023-27941MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, EPSS 0.3%CVE-2025-5808HIGHAuthentication Bypass vulnerability discovered in the OpenText™ Self-Service Password ResetEPSS 0.3%CVE-2026-31971HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.3%CVE-2026-66679MEDIUMWordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-23593MEDIUM A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from EPSS 0.3%CVE-2025-32689HIGHWordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerabilityEPSS 0.3%CVE-2026-82750HIGHUnbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationEPSS 0.3%CVE-2026-82751HIGHUnbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioningEPSS 0.3%