Weaknesses of type CWE-682

103 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%CVE-2026-20335HIGHCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Calculation VulnerabilitiesEPSS 0.4%CVE-2024-32873LOWevmos allows transferring unvested tokens after delegationsEPSS 0.4%CVE-2026-53217HIGHnet: mvpp2: sync RX data at the hardware packet offsetEPSS 0.4%CVE-2026-115786MEDIUMZimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionEPSS 0.4%CVE-2026-113007CRITICALIncorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions EPSS 0.4%CVE-2026-107721MEDIUMfast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)EPSS 0.3%CVE-2026-44074LOWBitwise OR of errno valuesEPSS 0.3%CVE-2025-26622LOWsqrt doesn't define rounding behavior in VyperEPSS 0.3%CVE-2026-20275HIGHCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.3%CVE-2026-33487HIGHgoxmldsig has validateSignature Loop Variable Capture Signature BypassEPSS 0.3%CVE-2024-25883MEDIUMThe mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.EPSS 0.3%CVE-2026-52920HIGHnetfilter: xt_policy: fix strict mode inbound policy matchingEPSS 0.3%CVE-2026-86736MEDIUMsnipe-it before 8.7.0 Checkout Request Counter Integrity FailureEPSS 0.3%CVE-2026-114117HIGHVyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary BranchesEPSS 0.3%CVE-2026-44498CRITICALZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsEPSS 0.3%CVE-2026-64176HIGHwifi: iwlwifi: mvm: fix driver-set TX rates on old devicesEPSS 0.3%CVE-2026-109410MEDIUMmacrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculationEPSS 0.3%CVE-2026-10773MEDIUMOut-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)EPSS 0.3%CVE-2026-28410MEDIUMThe Graph: Revocable vesting contracts allows early access to locked tokensEPSS 0.3%