Fallos del tipo CWE-1287

160 resultados

Validação inadequada do tipo de entrada

A aplicação falha em validar corretamente se a entrada recebida pertence ao tipo de dado esperado (string, inteiro, boolean, etc.) antes de usá-la. Isso permite que um atacante envie dados do tipo errado, causando comportamento inesperado, contorno de lógica de negócio ou execução de código malicioso.

Ejemplo

Um formulário de cadastro espera um CPF (string numérica), mas não valida o tipo; um atacante envia um objeto JSON ou um booleano no lugar. A aplicação tenta processar isso sem validação de tipo e acaba executando operações não previstas, como contorno de autenticação ou injeção de dados.

Cómo mitigar

Implemente validação explícita de tipo de entrada na camada de entrada (validadores, parsers com type-checking) e use linguagens ou frameworks com type hints/type checking rigoroso. Para APIs, documente e valide os tipos esperados em cada parâmetro antes de qualquer processamento lógico.

CVE-2024-2105MEDIUMJBL: Improper validation of ICM field in connection requestsEPSS 0.2%CVE-2019-25596MEDIUMSpotAuditor 5.2.6 Name Field Denial of ServiceEPSS 0.2%CVE-2025-32901MEDIUMIn KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.EPSS 0.2%CVE-2025-13352LOWMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingEPSS 0.2%CVE-2026-7887LOWFor Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusEPSS 0.2%CVE-2026-75588LOWMattermost Desktop App plugin popout scheme validation bypassEPSS 0.2%CVE-2025-20155MEDIUMA vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to aEPSS 0.2%CVE-2026-20074HIGHCisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service VulnerabilityEPSS 0.2%CVE-2025-30027MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only bEPSS 0.2%CVE-2025-4645MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only bEPSS 0.1%CVE-2024-6858MEDIUMIn Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.EPSS 0.1%CVE-2025-6298MEDIUMACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerabiEPSS 0.1%CVE-2026-82741LOWAsh.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionEPSS 0.1%CVE-2026-40851HIGHCommand injection via USBEPSS 0.1%CVE-2026-80051MEDIUMgithub.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The bEPSS 0.1%CVE-2025-8108MEDIUMAn ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vEPSS 0.1%CVE-2024-40682MEDIUMIBM SmartCloud Analytics - Log Analysis denial of serviceEPSS 0.1%CVE-2026-20498MEDIUMIn geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.1%CVE-2026-17113MEDIUMCri-o: cri-o: unvalidated image env var causes daemon crashEPSS 0.1%CVE-2026-94570MEDIUMCVE-2026-94570EPSS —