Weaknesses of type CWE-472

167 results

Estouro de inteiro

Ocorre quando uma operação aritmética produz um valor que ultrapassa o limite máximo (ou mínimo) que um tipo inteiro consegue representar, causando wrap-around silencioso ou comportamento inesperado. Um inteiro que deveria ser 2.147.483.648 vira -2.147.483.648 em um int de 32 bits, por exemplo. Isso pode levar a alocações de memória pequenas demais, comparações erradas ou lógica de negócio quebrada.

Example

Uma API recebe `tamanho_total = tamanho_header + tamanho_payload`. Se um atacante passa tamanho_header=INT_MAX e tamanho_payload=1000, a soma estoura e resulta em um número negativo ou muito pequeno, alocando um buffer insuficiente. O código então escreve dados além dos limites alocados.

How to mitigate

Validar limites antes de operações aritméticas (checar se a+b > MAX_INT antes de somar), usar tipos com range maior (long, BigInteger), ou usar bibliotecas que detectam overflow. Em C/C++, preferir operações que retornam erro em caso de overflow (ex: __builtin_add_overflow no GCC).

CVE-2026-77470HIGHLychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST requestEPSS 0.5%CVE-2025-66385CRITICALUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a highEPSS 0.5%CVE-2026-5274HIGHInteger overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted EPSS 0.4%CVE-2026-77999HIGHJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.4%CVE-2026-82189HIGHJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.4%CVE-2025-43933CRITICALfblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends EPSS 0.4%CVE-2025-22384HIGHAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the CEPSS 0.4%CVE-2024-6010MEDIUMCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price ManipulationEPSS 0.4%CVE-2026-7571HIGHKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataEPSS 0.4%CVE-2026-14430HIGHInteger overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2025-3743MEDIUMUpsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order ManipulationEPSS 0.4%CVE-2026-3914HIGHInteger overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.4%CVE-2026-59817MEDIUMGhost: Paid gift memberships obtainable at minimal cost via the donations featureEPSS 0.4%CVE-2025-27893LOWIn Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such aEPSS 0.4%CVE-2023-38520MEDIUMWordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter TamperingEPSS 0.4%CVE-2025-67846MEDIUMThe Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgradEPSS 0.4%CVE-2025-54832MEDIUMOPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modificationEPSS 0.4%CVE-2026-56877MEDIUMThe SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter aEPSS 0.4%CVE-2026-13841HIGHInteger overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.4%CVE-2025-8198HIGHMinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price ManipulationEPSS 0.4%