Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-44249HIGHNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingEPSS 1.0%CVE-2022-43723HIGHA vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software dEPSS 1.0%CVE-2021-20329MEDIUMSpecific cstrings input may not be properly validated in the Go DriverEPSS 0.9%CVE-2023-3917MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.9%CVE-2023-3900MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.9%CVE-2026-24307CRITICALM365 Copilot Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-96044HIGHMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-31948MEDIUMIn FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crashEPSS 0.8%CVE-2024-5594CRITICALOpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arEPSS 0.8%CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-3904MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2025-12977CRITICALCVE-2025-12977EPSS 0.8%CVE-2022-22228HIGHJunos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packetEPSS 0.7%CVE-2024-9404MEDIUMDenial-of-Service VulnerabilityEPSS 0.7%CVE-2026-97801HIGH.NET Framework Tampering VulnerabilityEPSS 0.7%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2024-43426HIGHMoodle: arbitrary file read risk through pdftexEPSS 0.7%CVE-2024-8403HIGHDenial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP ModuleEPSS 0.7%CVE-2021-44694MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.7%CVE-2025-20630MEDIUMMobile crash via object that can't be cast to String in Attachment FieldEPSS 0.6%