Fallos del tipo CWE-1284

327 resultados

Validação inadequada de quantidade especificada em entrada

Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.

Ejemplo

Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.

Cómo mitigar

Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.

CVE-2026-57364MEDIUMWordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerabilityEPSS 0.4%CVE-2026-76442HIGHCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.4%CVE-2026-82397HIGHTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopEPSS 0.4%CVE-2025-14511HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2026-93749HIGHsource-map-js through 1.2.1 Event Loop Denial of ServiceEPSS 0.4%CVE-2025-36427MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-5257MEDIUMPredictable Page Indexing Might Lead to Sensitive Data ExposureEPSS 0.3%CVE-2025-36424MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-61938HIGHBIG-IP Advanced WAF and ASM bd process vulnerabilityEPSS 0.3%CVE-2026-49218HIGHImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsEPSS 0.3%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.3%CVE-2021-46893—Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.EPSS 0.3%CVE-2025-36178MEDIUMMultiple vulnerabilities in IBM ControllerEPSS 0.3%CVE-2026-53540LOWPython-Multipart: Negative Content-Length in parse_form buffers the entire body in memoryEPSS 0.3%CVE-2026-71562MEDIUMhttpc does not bound server-supplied numeric header values before integer conversionEPSS 0.3%CVE-2023-27941MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, EPSS 0.3%CVE-2025-5808HIGHAuthentication Bypass vulnerability discovered in the OpenText™ Self-Service Password ResetEPSS 0.3%CVE-2026-31971HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.3%CVE-2026-66679MEDIUMWordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-23593MEDIUM A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from EPSS 0.3%