Fallos del tipo CWE-1284

327 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2025-32689HIGHWordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerabilityEPSS 0.3%CVE-2026-82751HIGHUnbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioningEPSS 0.3%CVE-2026-82750HIGHUnbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationEPSS 0.3%CVE-2026-1352MEDIUMIBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined indexEPSS 0.3%CVE-2026-78010HIGHFireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of ServiceEPSS 0.3%CVE-2026-16025HIGHImproper Payment Validation in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS ModuleEPSS 0.3%CVE-2025-8320HIGHTesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-9704MEDIUMKeycloak: keycloak: privilege escalation due to oversized subject_token jwtEPSS 0.3%CVE-2025-36428MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2024-31957MEDIUMA vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of nativeEPSS 0.3%CVE-2025-12385HIGHImproper validation of <img> tag size in Text component parserEPSS 0.3%CVE-2026-59531HIGHWordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerabilityEPSS 0.3%CVE-2026-40093HIGHnimiq-blockchain is missing a wall-clock upper bound on block timestampsEPSS 0.3%CVE-2025-52534MEDIUMImproper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integritEPSS 0.3%CVE-2026-2474HIGHCrypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()EPSS 0.3%CVE-2025-49292MEDIUMWordPress Profile Builder plugin <= 3.13.8 - Content Spoofing VulnerabilityEPSS 0.3%CVE-2023-0195LOWNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284, whEPSS 0.3%CVE-2026-27384CRITICALWordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityEPSS 0.3%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.3%CVE-2023-52343MEDIUMIn SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote infEPSS 0.3%