Fallos del tipo CWE-1284

387 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2024-20149HIGHIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional EPSS 0.8%CVE-2022-46143MEDIUMAffected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer EPSS 0.7%CVE-2022-4171MEDIUMdemon image annotation <= 5.0 - Improper Input Restriction ValidationEPSS 0.7%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%CVE-2023-30269HIGHCLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.EPSS 0.7%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2024-39697HIGHphonenumber panics on parsing crafted phonenumber inputsEPSS 0.7%CVE-2026-59696MEDIUMuri_string does not bound the port component of a URI before integer conversionEPSS 0.7%CVE-2026-70405MEDIUMsnmp BER INTEGER decoder applies no size limit to attacker-supplied integer fieldsEPSS 0.7%CVE-2024-9369HIGHInsufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer procEPSS 0.7%CVE-2024-1610HIGHOPPO Store app include remote account token hijacking and sensitive information leakageEPSS 0.7%CVE-2023-4518MEDIUMA vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a EPSS 0.7%CVE-2025-33211HIGHNVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. AEPSS 0.7%CVE-2026-6876CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 0.7%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2023-23549LOWDoS via long hostnamesEPSS 0.6%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.6%CVE-2026-87962HIGHt-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytesEPSS 0.6%CVE-2026-69210HIGHHttp4s: WebSocket decoder accepts negative length, causing infinite decode loopEPSS 0.6%