Weaknesses of type CWE-682

101 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2025-5372MEDIUMLibssh: incorrect return code handling in ssh_kdf() in libsshEPSS 0.5%CVE-2026-116541HIGHnetty-tcnative before 2.0.84.Final Denial of Service via BIO Write OvercountEPSS 0.5%CVE-2026-47247HIGHlibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane AllocationEPSS 0.5%CVE-2026-20270HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.5%CVE-2024-34704MEDIUMera-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimizationEPSS 0.5%CVE-2023-31347MEDIUMDue to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when SEPSS 0.5%CVE-2026-45988CRITICALrxrpc: Fix re-decryption of RESPONSE packetsEPSS 0.5%CVE-2026-10512LOWX25519 x86_64 assembly final reduction leaves non-canonical field elementEPSS 0.5%CVE-2026-101963HIGHJunos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is usedEPSS 0.4%CVE-2026-20236HIGHMultiple Cisco Products Snort 3 Software Hardening Release: October 2026EPSS 0.4%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.4%CVE-2026-18459HIGHIncorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.EPSS 0.4%CVE-2026-1229LOWIncorrect calculation in CIRCL secp384r1 CombinedMultEPSS 0.4%CVE-2023-36980—An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds thEPSS 0.4%CVE-2026-46244CRITICALnetfilter: nft_inner: Fix IPv6 inner_thoff desyncEPSS 0.4%CVE-2025-55552MEDIUMpytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.EPSS 0.4%CVE-2026-76043HIGHIncorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox EPSS 0.4%CVE-2026-24783HIGHsoroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with NegativesEPSS 0.4%CVE-2024-45056MEDIUM`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolcEPSS 0.4%CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%