Weaknesses of type CWE-682

103 results

Cálculo incorreto

Ocorre quando o código realiza uma operação matemática ou lógica com erro na fórmula, na ordem de operações, ou na manipulação de tipos de dados, produzindo um resultado inesperado. O risco varia: pode levar a autorizações indevidas, contornos de validação, ou corrupção de dados sensíveis, dependendo de onde o cálculo é usado.

Example

Um sistema calcula o desconto em uma compra usando (preço * percentual) / 100, mas o desenvolvedor inverte e faz (preço / 100) * percentual, resultando em desconto 100 vezes menor. Ou um controle de acesso nega permissões com if(level > 5) quando deveria ser if(level < 5), invertendo a lógica de proteção.

How to mitigate

Valide todas as operações matemáticas com testes unitários que cobrem casos extremos (zero, negativos, overflow). Revise fórmulas críticas em code review com especialista, use constantes nomeadas em vez de valores mágicos, e implemente verificações de sanidade no resultado (ex: desconto nunca > 100%) antes de usar.

CVE-2026-7836LOWhextoint macro uppercase bugEPSS 0.3%CVE-2026-21911HIGHJunos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stopEPSS 0.2%CVE-2026-25634HIGHiccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()EPSS 0.2%CVE-2023-43490MEDIUMIncorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to EPSS 0.2%CVE-2021-34573MEDIUMIncorrect calculation in Enbra EWM does not report backflows or no flow eventsEPSS 0.2%CVE-2026-45933HIGHbpf: Preserve id of register in sync_linked_regs()EPSS 0.2%CVE-2024-6287HIGHIncorrect Address Range CalculationsEPSS 0.2%CVE-2021-41222MEDIUMSegfault due to negative splits in `SplitV`EPSS 0.2%CVE-2026-97071MEDIUMWordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-76470HIGHCisco Meraki Hardening Release - Incorrect Calculation VulnerabilitiesEPSS 0.2%CVE-2026-106420MEDIUMIncorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering tEPSS 0.2%CVE-2026-53191HIGHio_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retriesEPSS 0.2%CVE-2026-43009HIGHbpf: Fix incorrect pruning due to atomic fetch precision trackingEPSS 0.2%CVE-2026-88371MEDIUMZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted CodeEPSS 0.2%CVE-2026-43321HIGHbpf: Properly mark live registers for indirect jumpsEPSS 0.2%CVE-2025-0036LOWIn AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause dEPSS 0.2%CVE-2026-20763MEDIUMIncorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of EPSS 0.1%CVE-2023-7346MEDIUMLedger Bitcoin App 2.1.0 Address Derivation Error via MiniscriptEPSS 0.1%CVE-2026-106438MEDIUMSilent Decimal128 value corruption via incorrect exactness check in MongoDB C DriverEPSS 0.1%CVE-2026-43033HIGHcrypto: authencesn - Do not place hiseq at end of dst for out-of-place decryptionEPSS 0.1%