Weaknesses of type CWE-241

33 results

Tratamento inadequado de tipo de dados inesperado

O código assume um tipo de dados específico (string, inteiro, objeto) sem validar o que realmente recebeu, causando comportamento imprevisto ou falha. Quando dados de tipo diferente chegam — por entrada do usuário, API, ou arquivo — o programa não consegue processar corretamente e pode falhar, expor informações ou executar lógica errada.

Example

Uma função espera receber um inteiro representando quantidade de itens, mas recebe uma string ou null. Sem validação, tenta fazer operações aritméticas diretamente, causando exceção ou resultado inválido. Em linguagens fracamente tipadas (JavaScript, PHP), pode resultar em coerção silenciosa que leva a lógica segura a se comportar de forma não esperada.

How to mitigate

Valide explicitamente o tipo de dados na entrada: use type-checking antes de processar (typeof, instanceof, ou validadores de schema como Joi, Zod). Em linguagens tipadas, configure verificação em tempo de compilação. Para dados desserializados (JSON, XML), use parsers seguros com type constraints claros.

CVE-2023-30591HIGHNodeBB Pre-Authentication Denial-of-ServiceEPSS 53.8%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.3%CVE-2021-39131HIGHImproper Handling of Unexpected Data Type in cedEPSS 1.9%CVE-2021-40116HIGHMultiple Cisco Products Snort Rule Denial of Service VulnerabilityEPSS 1.3%CVE-2022-24668—A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This aEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2021-32655LOWFiles Drop public link can be added as federated shareEPSS 1.0%CVE-2022-20730MEDIUMCisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass VulnerabilityEPSS 0.9%CVE-2024-25966MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthentEPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.7%CVE-2023-5215MEDIUMLibnbd: crash or misbehaviour when nbd server returns an unexpected block sizeEPSS 0.7%CVE-2022-1642—A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JEPSS 0.6%CVE-2024-21523HIGHAll versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuEPSS 0.6%CVE-2022-22219MEDIUMJunos OS and Junos OS Evolved: RPD core upon receipt of a specific EVPN route by a BGP route reflector in an EVPN environmentEPSS 0.6%CVE-2024-9423MEDIUMCertain HP LaserJet Printers – Potential Denial of ServiceEPSS 0.6%CVE-2024-21526HIGHAll versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyEPSS 0.6%CVE-2024-0151MEDIUMInsufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiledEPSS 0.4%CVE-2025-2268MEDIUMHP LaserJet MFP M232-M237 Printer Series - Potential Denial of ServiceEPSS 0.4%CVE-2023-28961MEDIUMJunos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is usedEPSS 0.4%CVE-2021-0242MEDIUMJunos OS: EX4300: FPC crash upon receipt of specific frames on an interface without L2PT or dot1x configuredEPSS 0.4%