Fallos del tipo CWE-1287

160 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-44935CRITICALRancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerEPSS 0.5%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2023-3906LOWImproper Validation of Specified Type of Input in GitLabEPSS 0.5%CVE-2026-4773HIGHOTP Bypass in Magarsus' IDM-MFAEPSS 0.5%CVE-2025-61672MEDIUMSynapse: Invalid device keys degrade federation functionalityEPSS 0.5%CVE-2025-24335LOWSOAP message input validation fault could in theory cause OAM service resource exhaustionEPSS 0.5%CVE-2025-20621MEDIUMWebapp crash via object that can't be cast to String in Attachment FieldEPSS 0.5%CVE-2025-24804MEDIUMPartial Denial of Service (DoS) in MobSFEPSS 0.5%CVE-2021-47156MEDIUMThe Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (EPSS 0.5%CVE-2026-54235MEDIUMvLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernelsEPSS 0.4%CVE-2026-33806HIGHfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type HeaderEPSS 0.4%CVE-2024-51551CRITICALDefault CredentialsEPSS 0.4%CVE-2025-20251HIGHCisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File DeletionEPSS 0.4%CVE-2023-28799HIGHA URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would reEPSS 0.4%CVE-2024-20408HIGHA vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat EPSS 0.4%CVE-2025-20086MEDIUMInsufficient Input Validation on Post PropsEPSS 0.4%CVE-2025-25020MEDIUMIBM QRadar Suite Software and IBM Cloud Pak for Security improper input validationEPSS 0.4%CVE-2025-55701HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-41729HIGHDoS via Modbus Read CommandEPSS 0.4%CVE-2026-9521MEDIUMfraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of inputEPSS 0.4%