Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2025-0476MEDIUMMobile crash via file with specially crafted filenameEPSS 0.4%CVE-2025-40911MEDIUMNet::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.4%CVE-2026-52763MEDIUMYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readEPSS 0.4%CVE-2025-54525HIGHUnexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.4%CVE-2023-47726HIGHIBM QRadar Suite improper input validationEPSS 0.4%CVE-2023-32651MEDIUMImproper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.24EPSS 0.4%CVE-2026-25179HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-47262MEDIUMDzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attaEPSS 0.4%CVE-2025-10207HIGHAuthenticated File Disclosure/DeleteEPSS 0.4%CVE-2025-9042HIGHRockwell Automation FLEX 5000 I/O - Module FaultEPSS 0.4%CVE-2025-9041HIGHRockwell Automation FLEX 5000 I/O - Module FaultEPSS 0.4%CVE-2023-47727MEDIUMIBM QRadar Suite Software file manipulationEPSS 0.3%CVE-2026-9742HIGHAuthenticate command with specific mechanism parameter can trigger server crashEPSS 0.3%CVE-2025-3070MEDIUMInsufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilEPSS 0.3%CVE-2025-40910MEDIUMNet::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.3%CVE-2026-49941HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate IP addressesEPSS 0.3%CVE-2025-8402MEDIUMNil pointer dereference in bulk import crashes serverEPSS 0.3%CVE-2026-2003MEDIUMPostgreSQL oidvector discloses a few bytes of memoryEPSS 0.3%CVE-2026-5304MEDIUMAn ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be explEPSS 0.3%CVE-2026-11460MEDIUMBoost Serialization improper validation of specified type of inputEPSS 0.3%