Fallos del tipo CWE-1284

327 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2022-28613HIGHSpecially Crafted Modbus TCP Packet Vulnerability in RTU500 seriesEPSS 1.0%CVE-2022-37312MEDIUMOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servletEPSS 0.9%CVE-2022-37311MEDIUMOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.EPSS 0.9%CVE-2022-0414MEDIUMImproper Validation of Specified Quantity in Input in dolibarr/dolibarrEPSS 0.9%CVE-2025-3511HIGHImproper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-LinEPSS 0.9%CVE-2026-2229HIGHundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationEPSS 0.9%CVE-2023-42444HIGHphonenumber panics on parsing crafted RF3966 inputsEPSS 0.9%CVE-2023-38744—Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port ofEPSS 0.9%CVE-2022-0174MEDIUMImproper Validation of Specified Quantity in Input in dolibarr/dolibarrEPSS 0.9%CVE-2026-3085HIGHGStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-4111MEDIUMImproper Validation of Specified Quantity in Input in tooljet/tooljetEPSS 0.8%CVE-2022-2277HIGHA vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...EPSS 0.8%CVE-2021-44693MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.7%CVE-2023-30269HIGHCLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.EPSS 0.7%CVE-2022-39313HIGHParse Server crashes when receiving file download request with invalid byte rangeEPSS 0.7%CVE-2024-20149HIGHIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional EPSS 0.7%CVE-2022-46143MEDIUMAffected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer EPSS 0.7%CVE-2022-4171MEDIUMdemon image annotation <= 5.0 - Improper Input Restriction ValidationEPSS 0.7%CVE-2024-39697HIGHphonenumber panics on parsing crafted phonenumber inputsEPSS 0.7%CVE-2023-4518MEDIUMA vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a EPSS 0.7%