Fallos del tipo CWE-1286

97 resultados

Validação inadequada da sintaxe de entrada

O software aceita entrada do usuário sem verificar corretamente se ela segue o formato esperado, permitindo dados malformados ou inesperados processarem normalmente. Isso pode levar a interpretações incorretas, injeções ou comportamentos impredizíveis quando o parser ou processador tenta lidar com dados que deveriam ser rejeitados.

Ejemplo

Um serviço web aceita um JSON sem validar se é válido (aspas desalinhadas, chaves incompletas), e ao processar com lenient parsing, um atacante injeta comandos ou campos extras que alteram a lógica da aplicação. Ou uma API que não valida um CSV antes de importar, permitindo que linhas malformadas causem execução de código ou corrupção de dados.

Cómo mitigar

Implemente validação sintática rigorosa antes de processar qualquer entrada: parse com strict mode, rejeite dados malformados explicitamente, e use schemas (JSON Schema, DTD, etc.). Nunca confie em lenient parsing ou tratamento silencioso de erros de sintaxe — falhe aberto (fail-safe).

CVE-2023-32649HIGHDoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0EPSS 0.6%CVE-2024-8160LOWErik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation EPSS 0.6%CVE-2026-48059HIGHNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionEPSS 0.6%CVE-2023-28985HIGHSRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is receivedEPSS 0.6%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2025-55085HIGHWeb http client: Unchecked Server-Side Malicious Packet IssueEPSS 0.6%CVE-2023-23903MEDIUMDoS via SAML configuration in Guardian/CMC before 22.6.2EPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%CVE-2023-43850MEDIUMImproper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated usEPSS 0.6%CVE-2024-21598HIGHJunos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashEPSS 0.6%CVE-2024-0218HIGHDoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1EPSS 0.6%CVE-2025-24812HIGHA vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1EPSS 0.5%CVE-2023-24015MEDIUMPartial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2EPSS 0.5%CVE-2024-21595HIGHJunos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hangEPSS 0.5%CVE-2025-13033HIGHNodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictEPSS 0.5%CVE-2024-21616HIGHJunos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failEPSS 0.5%CVE-2025-24348MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%CVE-2026-6918HIGHIn Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.EPSS 0.5%CVE-2025-41719HIGHSauter: Improper Validation of user-controlled dataEPSS 0.5%CVE-2025-24347MEDIUMA vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) EPSS 0.5%