Fallos del tipo CWE-1287

160 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-2454MEDIUMDoS in Calls plugin via malformed msgpack in websocket request.EPSS 0.3%CVE-2025-59275HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-59278HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-42916HIGHMissing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)EPSS 0.3%CVE-2026-29788HIGHTSPortal: Anyone can forge self-deletion requests of any userEPSS 0.3%CVE-2023-29126MEDIUMInsecure loose comparison in Enel X JuiceBoxEPSS 0.3%CVE-2026-45069HIGHSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsEPSS 0.3%CVE-2023-2431LOWBypass of seccomp profile enforcementEPSS 0.3%CVE-2025-9524MEDIUMThe VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerabilitEPSS 0.3%CVE-2026-4646MEDIUMInsufficient input validation in GitHub plugin API causes denial of serviceEPSS 0.3%CVE-2025-20756MEDIUMIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogEPSS 0.2%CVE-2025-52883MEDIUMMeshtastic-Android vulnerable to forged DMs with no PKC showing up as encryptedEPSS 0.2%CVE-2026-10825HIGHImproper JSON Input Validation in WebSocket API Leads to Denial of ServiceEPSS 0.2%CVE-2025-42929HIGHMissing input validation vulnerability in SAP Landscape Transformation Replication ServerEPSS 0.2%CVE-2026-5304MEDIUMAn ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be explEPSS 0.2%CVE-2024-3175HIGHInsufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalationEPSS 0.2%CVE-2026-52763MEDIUMYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2024-1578MEDIUMMultiple MiCard PLUS card reader dropped charactersEPSS 0.2%CVE-2025-53627MEDIUMMeshtastic firmware allows forged DMs with no PKC to show up as encryptedEPSS 0.2%