Fallos del tipo CWE-1287

160 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-24307CRITICALM365 Copilot Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-43723HIGHA vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software dEPSS 0.9%CVE-2023-3900MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.9%CVE-2024-5594CRITICALOpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arEPSS 0.8%CVE-2024-31948MEDIUMIn FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crashEPSS 0.8%CVE-2023-3917MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2023-3904MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2024-9404MEDIUMDenial-of-Service VulnerabilityEPSS 0.8%CVE-2025-12977CRITICALCVE-2025-12977EPSS 0.7%CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.7%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2024-43426HIGHMoodle: arbitrary file read risk through pdftexEPSS 0.7%CVE-2024-8403HIGHDenial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP ModuleEPSS 0.7%CVE-2022-22228HIGHJunos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packetEPSS 0.7%CVE-2026-50524HIGH.NET Framework Denial of Service VulnerabilityEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2024-56908MEDIUMIn Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providiEPSS 0.6%CVE-2023-2673MEDIUMPHOENIX CONTACT: FL/TC MGUARD prone to Improper Input ValidationEPSS 0.6%CVE-2024-47504HIGHJunos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crashEPSS 0.6%CVE-2021-44694MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.6%