Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-21932HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JaEPSS 0.5%CVE-2025-41650HIGHWeidmueller: Denial-of-Service Vulnerability in Industrial Ethernet SwitchesEPSS 0.5%CVE-2024-20494HIGHA vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefenseEPSS 0.5%CVE-2024-35213CRITICALVulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)EPSS 0.5%CVE-2026-18830HIGHInsufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness APIEPSS 0.5%CVE-2026-9390CRITICALXML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupEPSS 0.5%CVE-2025-41395MEDIUMWebapp DoS via malicious retrospective post in PlaybooksEPSS 0.5%CVE-2025-24876HIGHAuthentication bypass via authorization code injection in SAP ApprouterEPSS 0.5%CVE-2026-44935CRITICALRancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerEPSS 0.5%CVE-2026-87012MEDIUMOpen WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueEPSS 0.5%CVE-2025-20251HIGHCisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File DeletionEPSS 0.5%CVE-2025-20621MEDIUMWebapp crash via object that can't be cast to String in Attachment FieldEPSS 0.5%CVE-2025-61672MEDIUMSynapse: Invalid device keys degrade federation functionalityEPSS 0.5%CVE-2026-4773HIGHOTP Bypass in Magarsus' IDM-MFAEPSS 0.5%CVE-2026-94570MEDIUMCVE-2026-94570EPSS 0.5%CVE-2025-24804MEDIUMPartial Denial of Service (DoS) in MobSFEPSS 0.5%CVE-2026-107723HIGHfast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayEPSS 0.5%CVE-2021-47156MEDIUMThe Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (EPSS 0.5%CVE-2026-54235MEDIUMvLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernelsEPSS 0.4%CVE-2026-33806HIGHfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type HeaderEPSS 0.4%