Weaknesses of type CWE-1289

40 results

Validação inadequada de equivalência insegura em entrada

A aplicação falha ao validar corretamente equivalências entre diferentes representações de um mesmo valor de entrada, permitindo que um atacante contorne controles de segurança usando formatos alternativos. Por exemplo, aceitar '../../etc/passwd' e './..\..\etc\passwd' como equivalentes, mas validar apenas um deles, deixando o outro passar.

Example

Um firewall WAF bloqueia requisições com padrão '../' em URLs, mas o desenvolvedor não normaliza a entrada antes de validar. Um atacante consegue contornar usando '../', '..%2F', '..%5C' ou até '.\../' dependendo de como a aplicação interpreta a entrada em diferentes camadas (HTTP, filesystem, parser de URL).

How to mitigate

Normalize sempre a entrada para uma forma canônica única (decodifique URLs, resolva caminhos, converta maiúsculas/minúsculas conforme necessário) *antes* de validar contra a lista de bloqueio. Valide após normalização, não antes, e use whitelists de padrões seguros sempre que possível em vez de blacklists.

CVE-2026-48710MEDIUMStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksEPSS 36.3%KEVCVE-2024-45179HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web intEPSS 2.6%CVE-2026-47729MEDIUMSquid: Memory disclosure in FTP gatewayEPSS 1.5%CVE-2025-62718MEDIUMAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFEPSS 1.2%CVE-2026-33515MEDIUMSquid has issues in ICP message handlingEPSS 1.0%CVE-2022-0675MEDIUMPuppet Firewall Module May Leave Unmanaged RulesEPSS 0.9%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 0.7%CVE-2024-8372MEDIUMAngularJS improper sanitization in 'srcset' attributeEPSS 0.6%CVE-2024-45308MEDIUMMySQL & free URL mode allows to hide existing notes in hedgedocEPSS 0.6%CVE-2026-46644MEDIUMsymfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalenceEPSS 0.5%CVE-2026-86831HIGHImproper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKSEPSS 0.5%CVE-2026-33806HIGHfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type HeaderEPSS 0.4%CVE-2026-88255MEDIUMmpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slotEPSS 0.4%CVE-2026-33496HIGHOry Oathkeeper has an authentication bypass by cache key confusionEPSS 0.4%CVE-2026-19953MEDIUMURI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprepEPSS 0.4%CVE-2026-60074HIGHDate::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in checkEPSS 0.4%CVE-2026-74994MEDIUMinets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authEPSS 0.4%CVE-2026-89049HIGHServer-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager AgentEPSS 0.4%CVE-2026-39972HIGHMercure has a Topic Selector Cache Key CollisionEPSS 0.3%CVE-2026-3563MEDIUMImproper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with EPSS 0.3%