Fallos del tipo CWE-1286

110 resultados

Validação inadequada da sintaxe de entrada

O software aceita entrada do usuário sem verificar corretamente se ela segue o formato esperado, permitindo dados malformados ou inesperados processarem normalmente. Isso pode levar a interpretações incorretas, injeções ou comportamentos impredizíveis quando o parser ou processador tenta lidar com dados que deveriam ser rejeitados.

Ejemplo

Um serviço web aceita um JSON sem validar se é válido (aspas desalinhadas, chaves incompletas), e ao processar com lenient parsing, um atacante injeta comandos ou campos extras que alteram a lógica da aplicação. Ou uma API que não valida um CSV antes de importar, permitindo que linhas malformadas causem execução de código ou corrupção de dados.

Cómo mitigar

Implemente validação sintática rigorosa antes de processar qualquer entrada: parse com strict mode, rejeite dados malformados explicitamente, e use schemas (JSON Schema, DTD, etc.). Nunca confie em lenient parsing ou tratamento silencioso de erros de sintaxe — falhe aberto (fail-safe).

CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2024-51983HIGHUnauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.EPSS 11.8%CVE-2024-51982HIGHUnauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.EPSS 10.7%CVE-2025-13878HIGHMalformed BRID/HHIT records can cause named to terminate unexpectedlyEPSS 9.4%CVE-2026-21527MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 8.1%CVE-2023-27043MEDIUMThe email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2EPSS 2.5%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2022-1941HIGHOut of Memory issue in ProtocolBuffers for cpp and pythonEPSS 1.5%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 1.0%CVE-2026-72916MEDIUMMastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesEPSS 1.0%CVE-2024-6763LOWJetty URI parsing of invalid authorityEPSS 1.0%CVE-2021-31988—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and EPSS 1.0%CVE-2025-25007MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-31987—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipEPSS 0.9%CVE-2024-3384HIGHPAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsEPSS 0.9%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 0.9%CVE-2025-22868HIGHUnexpected memory consumption during token parsing in golang.org/x/oauth2EPSS 0.9%CVE-2022-22192HIGHJunos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the deviceEPSS 0.8%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.8%CVE-2024-29041MEDIUMExpress.js Open Redirect in malformed URLsEPSS 0.8%