Fallos del tipo CWE-1286

109 resultados

Validação inadequada da sintaxe de entrada

O software aceita entrada do usuário sem verificar corretamente se ela segue o formato esperado, permitindo dados malformados ou inesperados processarem normalmente. Isso pode levar a interpretações incorretas, injeções ou comportamentos impredizíveis quando o parser ou processador tenta lidar com dados que deveriam ser rejeitados.

Ejemplo

Um serviço web aceita um JSON sem validar se é válido (aspas desalinhadas, chaves incompletas), e ao processar com lenient parsing, um atacante injeta comandos ou campos extras que alteram a lógica da aplicação. Ou uma API que não valida um CSV antes de importar, permitindo que linhas malformadas causem execução de código ou corrupção de dados.

Cómo mitigar

Implemente validação sintática rigorosa antes de processar qualquer entrada: parse com strict mode, rejeite dados malformados explicitamente, e use schemas (JSON Schema, DTD, etc.). Nunca confie em lenient parsing ou tratamento silencioso de erros de sintaxe — falhe aberto (fail-safe).

CVE-2026-0663MEDIUMDenial of Service condition in M-Files ServerEPSS 0.4%CVE-2026-67418MEDIUMRabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribersEPSS 0.4%CVE-2026-6442HIGHImproper Command Detection Logic Allows RCE in Cortex Code Command-Line InterfaceEPSS 0.4%CVE-2024-6173MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowEPSS 0.4%CVE-2026-87080CRITICALNet::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycodeEPSS 0.4%CVE-2025-24345MEDIUMA vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mEPSS 0.4%CVE-2025-8873HIGHArista EOS Dataplane Denial of Service via Malformed IPsec PacketEPSS 0.4%CVE-2025-30415HIGHDenial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.4%CVE-2025-20644MEDIUMIn Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has coEPSS 0.4%CVE-2025-46419MEDIUMWestermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.EPSS 0.4%CVE-2022-22176HIGHJunos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packetEPSS 0.4%CVE-2026-111107HIGHFireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of ServiceEPSS 0.4%CVE-2026-20114MEDIUMA vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to eEPSS 0.4%CVE-2026-50131HIGHFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 rangesEPSS 0.4%CVE-2026-33778HIGHJunos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashesEPSS 0.3%CVE-2026-100902HIGHBarco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of inputEPSS 0.3%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.3%CVE-2026-88260HIGHAuthentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in BrainzcoEPSS 0.3%CVE-2026-40198HIGHNet::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypassEPSS 0.3%CVE-2026-83728HIGHWindows Hyper-V Spoofing VulnerabilityEPSS 0.3%