Fallos del tipo CWE-233

31 resultados

Manipulação Inadequada de Parâmetros

Ocorre quando o software não valida, sanitiza ou processa corretamente os parâmetros recebidos de fontes externas (usuário, API, arquivo, etc.). O código assume que os dados estão no formato esperado sem verificação, abrindo brechas para injeção, buffer overflow, lógica quebrada ou comportamento não intencional.

Ejemplo

Um serviço REST que recebe um ID de usuário como parâmetro e o passa diretamente em uma query SQL sem prepared statements (SELECT * FROM users WHERE id = {id}), permitindo SQL injection. Ou um programa que copia um parâmetro de tamanho fornecido pelo usuário para um buffer fixo sem checar limites, causando estouro.

Cómo mitigar

Sempre validar e sanitizar entrada: verificar tipo, tamanho, formato e range esperados antes de usar. Use prepared statements para SQL, escapar valores em contextos de comando/script, implementar whitelist de valores aceitos quando possível. Falhe de forma segura — rejeite entrada suspeita em vez de tentar 'consertar'.

CVE-2025-52970HIGHA improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.EPSS 9.8%CVE-2023-20076HIGHCisco IOx Application Hosting Environment Command Injection VulnerabilityEPSS 1.5%CVE-2021-1230HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityEPSS 1.5%CVE-2024-24525CRITICALAn issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametEPSS 1.1%CVE-2024-31808HIGHTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in EPSS 0.9%CVE-2022-45182CRITICALPi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.EPSS 0.9%CVE-2021-0269HIGHJunos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.EPSS 0.9%CVE-2022-3697A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. ThEPSS 0.7%CVE-2024-9329MEDIUMGlassfish redirect to untrusted siteEPSS 0.7%CVE-2022-32261MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguratEPSS 0.7%CVE-2024-33433MEDIUMCross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via thEPSS 0.6%CVE-2022-22792MEDIUMMobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersEPSS 0.6%CVE-2021-45477MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2021-45478MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2024-25979MEDIUMMsa-24-0002: forum search accepted random parameters in its urlEPSS 0.6%CVE-2026-2370HIGHImproper Handling of Parameters in GitLabEPSS 0.4%CVE-2023-26549The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability maEPSS 0.4%CVE-2026-32998CRITICALThis vulnerability in Veeam Service Provider Console allows for remote code execution.EPSS 0.4%CVE-2020-10069MEDIUMZephyr Bluetooth unchecked packet data results in denial of serviceEPSS 0.4%CVE-2023-1419MEDIUMDebezium: script injection via connector parameterEPSS 0.4%