Fallos del tipo CWE-1284

387 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2026-53540LOWPython-Multipart: Negative Content-Length in parse_form buffers the entire body in memoryEPSS 0.3%CVE-2025-5808HIGHAuthentication Bypass vulnerability discovered in the OpenText™ Self-Service Password ResetEPSS 0.3%CVE-2023-27941MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, EPSS 0.3%CVE-2025-12385HIGHImproper validation of <img> tag size in Text component parserEPSS 0.3%CVE-2025-36428MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-43881MEDIUMImproper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a deniEPSS 0.3%CVE-2024-23593MEDIUM A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from EPSS 0.3%CVE-2025-32689HIGHWordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerabilityEPSS 0.3%CVE-2026-1352MEDIUMIBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined indexEPSS 0.3%CVE-2026-70378HIGHimagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable PanicEPSS 0.3%CVE-2026-40093HIGHnimiq-blockchain is missing a wall-clock upper bound on block timestampsEPSS 0.3%CVE-2026-9704MEDIUMKeycloak: keycloak: privilege escalation due to oversized subject_token jwtEPSS 0.3%CVE-2025-49292MEDIUMWordPress Profile Builder plugin <= 3.13.8 - Content Spoofing VulnerabilityEPSS 0.3%CVE-2024-31957MEDIUMA vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of nativeEPSS 0.3%CVE-2026-26934MEDIUMImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2023-0195LOWNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284, whEPSS 0.3%CVE-2026-112112LOWAn IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matchiEPSS 0.3%CVE-2025-36407MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-13507HIGHTime-series operations may cause internal BSON size limit to be exceedEPSS 0.3%CVE-2025-36015MEDIUMIBM Controller Denial of ServiceEPSS 0.3%