Fallos del tipo CWE-1287

171 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2026-4646MEDIUMInsufficient input validation in GitHub plugin API causes denial of serviceEPSS 0.3%CVE-2025-42929HIGHMissing input validation vulnerability in SAP Landscape Transformation Replication ServerEPSS 0.2%CVE-2026-10825HIGHImproper JSON Input Validation in WebSocket API Leads to Denial of ServiceEPSS 0.2%CVE-2024-3175HIGHInsufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalationEPSS 0.2%CVE-2026-75588LOWMattermost Desktop App plugin popout scheme validation bypassEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2024-1578MEDIUMMultiple MiCard PLUS card reader dropped charactersEPSS 0.2%CVE-2025-53627MEDIUMMeshtastic firmware allows forged DMs with no PKC to show up as encryptedEPSS 0.2%CVE-2019-25596MEDIUMSpotAuditor 5.2.6 Name Field Denial of ServiceEPSS 0.2%CVE-2024-2105MEDIUMJBL: Improper validation of ICM field in connection requestsEPSS 0.2%CVE-2025-32901MEDIUMIn KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.EPSS 0.2%CVE-2026-82741LOWAsh.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionEPSS 0.2%CVE-2026-115383MEDIUMWasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag ImportsEPSS 0.2%CVE-2026-80051MEDIUMgithub.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The bEPSS 0.2%CVE-2026-20074HIGHCisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service VulnerabilityEPSS 0.2%CVE-2026-110985CRITICALApache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredEPSS 0.2%CVE-2025-13352LOWMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingEPSS 0.2%CVE-2025-20155MEDIUMA vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to aEPSS 0.2%CVE-2026-7887LOWFor Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusEPSS 0.2%CVE-2025-30027MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only bEPSS 0.2%