Weaknesses of type CWE-682

76 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2022-26517MEDIUMOn F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAEPSS 0.8%CVE-2021-41122MEDIUMBounds check missing for decimal args in VyperEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.7%CVE-2022-39242MEDIUMIncorrect Calculation in Frontier leads to inflated Ethereum chain gas pricesEPSS 0.7%CVE-2023-26488MEDIUMOpenZeppelin Contracts contains Incorrect CalculationEPSS 0.7%CVE-2022-23001MEDIUMSweet-B Library: Point compress/decompress using the wrong bit for signEPSS 0.7%CVE-2023-46247HIGHVyper has incorrect storage layout for contracts containing large arraysEPSS 0.7%CVE-2022-36795MEDIUMBIG-IP software SYN cookies vulnerability CVE-2022-36795EPSS 0.7%CVE-2025-4435HIGHTarfile extracts filtered members when errorlevel=0EPSS 0.6%CVE-2024-11407MEDIUMDenial of Service through Data corruption in gRPC-C++EPSS 0.6%CVE-2024-36736CRITICALAn issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation iEPSS 0.6%CVE-2023-42460MEDIUM_abi_decode input not validated in complex expressions in VyperEPSS 0.6%CVE-2025-54427MEDIUMPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas priceEPSS 0.5%CVE-2023-1296LOWNomad ACLs Can Not Deny Access to Workload's Own VariablesEPSS 0.5%CVE-2026-71479CRITICALNew API: Integer overflow in quota billing yields negative charges (self-crediting)EPSS 0.5%CVE-2026-47247HIGHlibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane AllocationEPSS 0.5%CVE-2024-34704MEDIUMera-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimizationEPSS 0.5%CVE-2023-31347MEDIUMDue to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when SEPSS 0.5%CVE-2026-10512LOWX25519 x86_64 assembly final reduction leaves non-canonical field elementEPSS 0.5%CVE-2026-76043HIGHIncorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox EPSS 0.4%