Weaknesses of type CWE-472

140 results

Estouro de inteiro

Ocorre quando uma operação aritmética produz um valor que ultrapassa o limite máximo (ou mínimo) que um tipo inteiro consegue representar, causando wrap-around silencioso ou comportamento inesperado. Um inteiro que deveria ser 2.147.483.648 vira -2.147.483.648 em um int de 32 bits, por exemplo. Isso pode levar a alocações de memória pequenas demais, comparações erradas ou lógica de negócio quebrada.

Example

Uma API recebe `tamanho_total = tamanho_header + tamanho_payload`. Se um atacante passa tamanho_header=INT_MAX e tamanho_payload=1000, a soma estoura e resulta em um número negativo ou muito pequeno, alocando um buffer insuficiente. O código então escreve dados além dos limites alocados.

How to mitigate

Validar limites antes de operações aritméticas (checar se a+b > MAX_INT antes de somar), usar tipos com range maior (long, BigInteger), ou usar bibliotecas que detectam overflow. Em C/C++, preferir operações que retornam erro em caso de overflow (ex: __builtin_add_overflow no GCC).

CVE-2024-25153CRITICALRemote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114EPSS 41.7%CVE-2025-6191HIGHInteger overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory accessEPSS 9.5%CVE-2025-7656HIGHInteger overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 9.1%CVE-2017-5261—In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative consoleEPSS 8.9%CVE-2017-5260—In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available iEPSS 8.1%CVE-2025-10891HIGHInteger overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 6.6%CVE-2021-1293CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 5.4%CVE-2021-1294CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.5%CVE-2021-1290CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.2%CVE-2021-1291CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.2%CVE-2021-1289CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.2%CVE-2021-1295CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.2%CVE-2021-1292CRITICALCisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution VulnerabilitiesEPSS 4.2%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.1%CVE-2019-13927—A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web moduEPSS 1.7%CVE-2020-1765LOWSpoofing of From field in several screensEPSS 1.5%CVE-2022-30597—A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.EPSS 1.3%CVE-2024-22049MEDIUMhttparty Multipart/Form-Data Request Tampering VulnerabilityEPSS 1.3%CVE-2025-35939MEDIUMCraft CMS stores user-provided content in session filesEPSS 1.3%KEVCVE-2021-27769MEDIUMHCL Sametime is vulnerable to an information disclosureEPSS 0.7%