Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2024-20408HIGHA vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat EPSS 0.4%CVE-2025-20086MEDIUMInsufficient Input Validation on Post PropsEPSS 0.4%CVE-2024-51551CRITICALDefault CredentialsEPSS 0.4%CVE-2023-28799HIGHA URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would reEPSS 0.4%CVE-2025-25020MEDIUMIBM QRadar Suite Software and IBM Cloud Pak for Security improper input validationEPSS 0.4%CVE-2025-41729HIGHDoS via Modbus Read CommandEPSS 0.4%CVE-2026-89207MEDIUMA vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17EPSS 0.4%CVE-2026-20119HIGHCisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service VulnerabilityEPSS 0.4%CVE-2026-110857HIGHGitPython before 3.2.0 Command Execution via ls_remote ext:: URLsEPSS 0.4%CVE-2025-20327HIGHA vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of sEPSS 0.4%CVE-2025-55701HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-0325MEDIUMA Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to EPSS 0.4%CVE-2026-9521MEDIUMfraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of inputEPSS 0.4%CVE-2026-0802MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalatEPSS 0.4%CVE-2022-22168MEDIUMJunos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC rebootEPSS 0.4%CVE-2024-47261MEDIUM51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validEPSS 0.4%CVE-2025-59277HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-1558MEDIUMDenial of Service Via Malicious GIFEPSS 0.4%CVE-2026-2092HIGHKeycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsEPSS 0.4%CVE-2025-60633MEDIUMAn issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagementEPSS 0.4%