Weaknesses of type CWE-682

65 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2023-35641HIGHInternet Connection Sharing (ICS) Remote Code Execution VulnerabilityEPSS 7.2%CVE-2020-0022HIGHIn reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This couldEPSS 5.4%CVE-2022-30600—A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.EPSS 5.1%CVE-2021-45960HIGHIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehEPSS 4.2%CVE-2023-2163CRITICALIncorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege EscalationEPSS 3.5%CVE-2022-23066CRITICALSolana rBPF - Incorrect Calculation in sdiv instructionEPSS 2.4%CVE-2021-31440HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first oEPSS 1.8%CVE-2020-26240MEDIUMErroneous Proof of Work calculation in gethEPSS 1.6%CVE-2020-28393—An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. SuccessfuEPSS 1.6%CVE-2022-31104MEDIUMMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeEPSS 1.6%CVE-2020-26262HIGHLoopback bypass in CoturnEPSS 1.3%CVE-2023-35642MEDIUMInternet Connection Sharing (ICS) Denial of Service VulnerabilityEPSS 1.3%CVE-2020-26241MEDIUMShallow copy bug in gethEPSS 1.1%CVE-2022-23628MEDIUMArray literal misordering in github.com/open-policy-agent/opaEPSS 1.0%CVE-2022-23011—On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while prEPSS 0.9%CVE-2020-26265MEDIUMConsensus flaw during block processingEPSS 0.9%CVE-2022-23028—On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookEPSS 0.9%CVE-2023-28431HIGHFrontier's modexp precompile is slow for even modulusEPSS 0.9%CVE-2022-31169MEDIUMCranelift vulnerable to miscompilation of constant values in division on AArch64EPSS 0.8%CVE-2021-41122MEDIUMBounds check missing for decimal args in VyperEPSS 0.8%