Weaknesses of type CWE-670

101 results

Validação inadequada de entrada

A aplicação aceita dados do usuário sem verificar se estão no formato, tamanho ou tipo esperado, permitindo que valores malformados ou maliciosos sejam processados. Isso abre porta para injeção, estouro de buffer, lógica corrompida e outros ataques.

Example

Um formulário web que recebe um CPF sem verificar se contém apenas dígitos, ou que aceita um campo 'idade' como string sem validar se é um número positivo. Um atacante envia valores inesperados (SQL injection, scripts) que a aplicação processa como legítimos.

How to mitigate

Implemente validação em todos os pontos de entrada: whitelist de caracteres permitidos, limites de tamanho, tipagem explícita, e rejeite dados que não correspondam ao esperado. Valide tanto no cliente (UX) quanto no servidor (segurança).

CVE-2026-38361HIGHMultiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_EPSS 2.6%CVE-2020-1914—A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fEPSS 2.5%CVE-2022-31116HIGHIncorrect handling of invalid surrogate pair characters in ujsonEPSS 2.3%CVE-2021-1236MEDIUMMultiple Cisco Products Snort Application Detection Engine Policy Bypass VulnerabilityEPSS 2.1%CVE-2022-31111MEDIUMDiscrepency in transfer value and actual value due to incorrect truncation in FrontierEPSS 1.3%CVE-2021-43839HIGHDrainage of FeeCollector's Block Transaction FeesEPSS 1.3%CVE-2022-29255HIGHMultiple evaluation of contract address in call in vyperEPSS 1.3%CVE-2023-1668HIGHA flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action mEPSS 1.2%CVE-2022-21655HIGHIncorrect handling of internal redirects results in crash in EnvoyEPSS 1.1%CVE-2022-21679MEDIUMAuthorization Policy bypass in IstioEPSS 1.1%CVE-2024-38365HIGHbtcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionalityEPSS 1.0%CVE-2021-0273MEDIUMJunos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.EPSS 1.0%CVE-2021-41153HIGHSpecification non-compliance in JUMPIEPSS 1.0%CVE-2022-26890HIGHOn F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.EPSS 0.9%CVE-2024-33431MEDIUMAn issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.EPSS 0.9%CVE-2023-30629HIGHVyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success valueEPSS 0.9%CVE-2025-43359CRITICALA logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS SeqEPSS 0.9%CVE-2022-35917MEDIUMWeakness in Transfer Validation Logic in @solana/payEPSS 0.8%CVE-2024-52811HIGHAcks not validated before logged to qlog leads to buffer overflow in ngtcp2EPSS 0.8%CVE-2022-45196HIGHHyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the samEPSS 0.8%