Weaknesses of type CWE-472

154 results

Estouro de inteiro

Ocorre quando uma operação aritmética produz um valor que ultrapassa o limite máximo (ou mínimo) que um tipo inteiro consegue representar, causando wrap-around silencioso ou comportamento inesperado. Um inteiro que deveria ser 2.147.483.648 vira -2.147.483.648 em um int de 32 bits, por exemplo. Isso pode levar a alocações de memória pequenas demais, comparações erradas ou lógica de negócio quebrada.

Example

Uma API recebe `tamanho_total = tamanho_header + tamanho_payload`. Se um atacante passa tamanho_header=INT_MAX e tamanho_payload=1000, a soma estoura e resulta em um número negativo ou muito pequeno, alocando um buffer insuficiente. O código então escreve dados além dos limites alocados.

How to mitigate

Validar limites antes de operações aritméticas (checar se a+b > MAX_INT antes de somar), usar tipos com range maior (long, BigInteger), ou usar bibliotecas que detectam overflow. Em C/C++, preferir operações que retornam erro em caso de overflow (ex: __builtin_add_overflow no GCC).

CVE-2021-27770MEDIUMHCL Sametime is vulnerable to arbitrary HTTP requestsEPSS 0.7%CVE-2024-7025HIGHInteger overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 0.7%CVE-2024-3649MEDIUMContact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price ManipulationEPSS 0.7%CVE-2026-2649HIGHInteger overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.7%CVE-2026-65052HIGHNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsEPSS 0.6%CVE-2023-28512MEDIUMIBM Watson CP4D Data Stores improper input validationEPSS 0.5%CVE-2025-3530HIGHWordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price ManipulationEPSS 0.5%CVE-2025-47817HIGHIn BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.EPSS 0.5%CVE-2026-3538HIGHInteger overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acceEPSS 0.5%CVE-2025-29788MEDIUMSylius PayPal Plugin Payment Amount Manipulation VulnerabilityEPSS 0.5%CVE-2025-47245HIGHIn BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.EPSS 0.5%CVE-2024-50703MEDIUMTeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.EPSS 0.5%CVE-2026-3536HIGHInteger overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory accEPSS 0.5%CVE-2025-43930CRITICALHashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the EPSS 0.5%CVE-2026-2519MEDIUMOnline Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'EPSS 0.5%CVE-2025-66385CRITICALUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a highEPSS 0.4%CVE-2024-6010MEDIUMCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price ManipulationEPSS 0.4%CVE-2025-22384HIGHAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the CEPSS 0.4%CVE-2026-5274HIGHInteger overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted EPSS 0.4%CVE-2026-14430HIGHInteger overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%