Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2024-8058HIGHAn improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary EPSS 0.3%CVE-2026-25783MEDIUMDenial of service via malformed User-Agent header in getBrowserVersionEPSS 0.3%CVE-2025-58084LOWMattermost Desktop App crashes when clicking on malformed external URLEPSS 0.3%CVE-2024-42189MEDIUMHCL BigFix Web Reports might be subject to a Denial of Service (DoS) attackEPSS 0.3%CVE-2026-9753HIGHServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.EPSS 0.3%CVE-2026-29788HIGHTSPortal: Anyone can forge self-deletion requests of any userEPSS 0.3%CVE-2026-2454MEDIUMDoS in Calls plugin via malformed msgpack in websocket request.EPSS 0.3%CVE-2025-12689MEDIUMDoS in Calls plugin via malformed UTF-8 in WebSocket requestEPSS 0.3%CVE-2024-12756HIGHAvaya Spaces HTML injection (HTMLi) VulnerabilityEPSS 0.3%CVE-2025-42916HIGHMissing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)EPSS 0.3%CVE-2024-8125MEDIUMA remote code vulnerability has been discovered in OpenText™ Content Management.EPSS 0.3%CVE-2025-59275HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-59278HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-90458MEDIUMOpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.EPSS 0.3%CVE-2025-9524MEDIUMThe VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerabilitEPSS 0.3%CVE-2025-20756MEDIUMIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogEPSS 0.3%CVE-2025-52883MEDIUMMeshtastic-Android vulnerable to forged DMs with no PKC showing up as encryptedEPSS 0.3%CVE-2023-29126MEDIUMInsecure loose comparison in Enel X JuiceBoxEPSS 0.3%CVE-2026-45069HIGHSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsEPSS 0.3%CVE-2023-2431LOWBypass of seccomp profile enforcementEPSS 0.3%