Fallos del tipo CWE-1288

39 resultados

Validação inconsistente de entrada

A aplicação não valida a consistência lógica entre diferentes campos ou parâmetros da entrada do usuário, aceitando dados contraditórios ou incoerentes que deveriam ser rejeitados. Isso permite que um atacante envie combinações de valores que violam regras de negócio, causando comportamento imprevisto, bypass de controles ou corrupção de estado.

Ejemplo

Um sistema bancário valida que cada campo (data, valor, conta) existe, mas não valida que a data da transação não pode ser no futuro, ou que a conta de origem não pode ser a mesma da conta de destino. Um atacante envia dados tecnicamente 'válidos' que violam a lógica esperada.

Cómo mitigar

Implemente validação em conjunto (não apenas campo a campo): verifique relacionamentos lógicos entre campos antes de processar. Use testes de integridade semântica — não apenas formato — e documente explicitamente quais combinações são legítimas no seu modelo de dados.

CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2022-39353CRITICALxmldom allows multiple root nodes in a DOMEPSS 1.6%CVE-2023-6245HIGHInfinite decoding loop through specially crafted payloadEPSS 1.2%CVE-2021-41531—Invalid RPKI data could disable Route Origin Validation on RTR clients.EPSS 0.9%CVE-2023-1620MEDIUMWAGO: DoS in multiple products in multiple versions using CodesysEPSS 0.9%CVE-2024-25951HIGHA command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating systEPSS 0.8%CVE-2026-69793HIGHWindows TCP/IP Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2023-1619MEDIUMWAGO: DoS in multiple versions of multiple productsEPSS 0.8%CVE-2024-8305MEDIUMMongoDB Server secondaries may crash due to forced index constraintsEPSS 0.6%CVE-2024-5953MEDIUM389-ds-base: malformed userpassword hash may cause denial of serviceEPSS 0.6%CVE-2024-31136HIGHIn JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameterEPSS 0.5%CVE-2024-12093MEDIUMImproper Validation of Consistency within Input in GitLabEPSS 0.5%CVE-2026-73219MEDIUMCVAT: Denial of service with regards to automatic annotationEPSS 0.5%CVE-2026-43001HIGHAn issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for aEPSS 0.5%CVE-2026-94200HIGHTLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in sslEPSS 0.5%CVE-2024-39515HIGHJunos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crashEPSS 0.5%CVE-2026-101951HIGHJunos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertisedEPSS 0.4%CVE-2024-31140MEDIUMIn JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing toolsEPSS 0.4%CVE-2026-18794HIGHOpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwriteEPSS 0.4%CVE-2026-15943MEDIUMKeycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url changeEPSS 0.4%