Fallos del tipo CWE-1284

327 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2026-19026MEDIUMNbit filter NULL/short parameter-array dereferenceEPSS 0.2%CVE-2026-82752MEDIUMAsh string length constraints count graphemes, so a combining-mark string of any size passes max_lengthEPSS 0.2%CVE-2026-19028MEDIUMHDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds readEPSS 0.2%CVE-2026-53720MEDIUMpymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too smallEPSS 0.2%CVE-2025-11743HIGHRockwell Automation CompactLogix® 5370 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-46033HIGHcrypto: authencesn - reject short ahash digests during instance creationEPSS 0.2%CVE-2022-20491HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.2%CVE-2024-3185MEDIUMRapid7 Insight Agent Sensitive Key Exposed To Local UsersEPSS 0.2%CVE-2023-20582MEDIUMImproper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults EPSS 0.2%CVE-2026-2403MEDIUMCWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting loEPSS 0.2%CVE-2023-20581LOWImproper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory intEPSS 0.2%CVE-2022-20543LOWIn multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service wEPSS 0.2%CVE-2023-20515MEDIUMImproper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leadingEPSS 0.2%CVE-2024-21953MEDIUMImproper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integriEPSS 0.2%CVE-2026-45201HIGHGPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memoryEPSS 0.2%CVE-2026-40272HIGHVulnerability in the QNX libtraceparser Impacts QNX Software Development PlatformEPSS 0.2%CVE-2026-85201MEDIUMIn Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf mEPSS 0.2%CVE-2024-53922MEDIUMAn issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length checEPSS 0.2%CVE-2026-55392MEDIUMNILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_sizeEPSS 0.2%CVE-2023-31304LOWImproper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe® lanEPSS 0.2%