Weaknesses of type CWE-1286

97 results

Validação inadequada da sintaxe de entrada

A aplicação aceita dados de entrada sem verificar se estão sintaticamente corretos conforme o formato esperado (JSON, XML, CSV, expressões regulares, etc.). Isso permite que dados malformados ou injetados passem pela validação e causem comportamentos inesperados: parsing incorreto, execução de lógica não prevista ou até injeção de código.

Example

Um parser JSON que não valida chaves duplicadas ou tipos de dados antes de processar deixa passar um payload malicioso. Ou um formulário que aceita emails sem verificar o símbolo '@', causando erro em operações que assumem formato válido.

How to mitigate

Sempre validar entrada contra um schema ou padrão esperado (whitelist) antes de processar: use bibliotecas de parsing robustas com validação integrada, implemente regex ou schema validation (JSONSchema, etc.), e teste com entradas malformadas. Rejeitar (não apenas limpar) dados sintaticamente inválidos.

CVE-2023-32649HIGHDoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0EPSS 0.6%CVE-2024-8160LOWErik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation EPSS 0.6%CVE-2026-48059HIGHNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionEPSS 0.6%CVE-2023-28985HIGHSRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is receivedEPSS 0.6%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2025-55085HIGHWeb http client: Unchecked Server-Side Malicious Packet IssueEPSS 0.6%CVE-2023-23903MEDIUMDoS via SAML configuration in Guardian/CMC before 22.6.2EPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%CVE-2023-43850MEDIUMImproper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated usEPSS 0.6%CVE-2024-21598HIGHJunos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashEPSS 0.6%CVE-2024-0218HIGHDoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1EPSS 0.6%CVE-2025-24812HIGHA vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1EPSS 0.5%CVE-2025-41719HIGHSauter: Improper Validation of user-controlled dataEPSS 0.5%CVE-2023-24015MEDIUMPartial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2EPSS 0.5%CVE-2024-21595HIGHJunos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hangEPSS 0.5%CVE-2025-13033HIGHNodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictEPSS 0.5%CVE-2024-21616HIGHJunos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failEPSS 0.5%CVE-2025-24348MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%CVE-2026-6918HIGHIn Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.EPSS 0.5%CVE-2025-24347MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%