Fallos del tipo CWE-1286

97 resultados

Validação inadequada da sintaxe de entrada

O software aceita entrada do usuário sem verificar corretamente se ela segue o formato esperado, permitindo dados malformados ou inesperados processarem normalmente. Isso pode levar a interpretações incorretas, injeções ou comportamentos impredizíveis quando o parser ou processador tenta lidar com dados que deveriam ser rejeitados.

Ejemplo

Um serviço web aceita um JSON sem validar se é válido (aspas desalinhadas, chaves incompletas), e ao processar com lenient parsing, um atacante injeta comandos ou campos extras que alteram a lógica da aplicação. Ou uma API que não valida um CSV antes de importar, permitindo que linhas malformadas causem execução de código ou corrupção de dados.

Cómo mitigar

Implemente validação sintática rigorosa antes de processar qualquer entrada: parse com strict mode, rejeite dados malformados explicitamente, e use schemas (JSON Schema, DTD, etc.). Nunca confie em lenient parsing ou tratamento silencioso de erros de sintaxe — falhe aberto (fail-safe).

CVE-2025-54995MEDIUMAsterisk remotely exploitable leak of RTP UDP ports and internal resourcesEPSS 0.5%CVE-2025-24346HIGHA vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maEPSS 0.5%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2025-0638HIGHRoutinator crashes when illegal characters are present in manifest file namesEPSS 0.5%CVE-2024-39542HIGHJunos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashEPSS 0.5%CVE-2024-52362MEDIUMIBM App Connect Enterprise Certified Container denial of serviceEPSS 0.5%CVE-2026-57026HIGHJunos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashEPSS 0.5%CVE-2025-10954MEDIUMVersions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of InputEPSS 0.5%CVE-2024-8772MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition EPSS 0.4%CVE-2025-11573HIGHDenial of Service issue in Amazon.IonDotnetEPSS 0.4%CVE-2026-21917HIGHJunos OS: SRX Series: Specifically malformed SSL packet causes FPC crashEPSS 0.4%CVE-2026-0663MEDIUMDenial of Service condition in M-Files ServerEPSS 0.4%CVE-2024-6173MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowEPSS 0.4%CVE-2025-8873HIGHArista EOS Dataplane Denial of Service via Malformed IPsec PacketEPSS 0.4%CVE-2025-20644MEDIUMIn Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has coEPSS 0.4%CVE-2025-46419MEDIUMWestermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.EPSS 0.4%CVE-2025-30415HIGHDenial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.4%CVE-2022-22176HIGHJunos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packetEPSS 0.4%CVE-2025-24345MEDIUMA vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mEPSS 0.4%CVE-2026-72916MEDIUMMastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesEPSS 0.4%