Fallos del tipo CWE-440

48 resultados

Violação de Comportamento Esperado

É quando o software faz algo diferente do que deveria fazer conforme sua especificação ou contrato — seja por lógica errada, tratamento inadequado de casos extremos ou falha em validações críticas. O perigo está em que a aplicação pode se comportar de forma impredizível em produção, abrindo brechas para exploração ou corrupção de dados.

Ejemplo

Um sistema bancário que deveria rejeitar transações acima de um limite diário, mas por erro de lógica as aprova mesmo assim. Ou um controle de acesso que deixa passar permissões quando a validação falha, em vez de negar por padrão.

Cómo mitigar

Implemente testes unitários e de integração que cubram comportamentos esperados e casos extremos; use especificações formais ou contratos (como assertions) no código; revise lógica condicional crítica em code review focando em 'o que deveria acontecer aqui?'.

CVE-2019-5108HIGHAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerabilitEPSS 10.1%CVE-2023-6129MEDIUMPOLY1305 MAC implementation corrupts vector registers on PowerPCEPSS 2.3%CVE-2021-41035—In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methEPSS 1.8%CVE-2023-4807HIGHPOLY1305 MAC implementation corrupts XMM registers on WindowsEPSS 1.6%CVE-2018-12550—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only commeEPSS 1.4%CVE-2019-6569—The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.EPSS 1.3%CVE-2023-2088MEDIUMA flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A rEPSS 1.2%CVE-2019-5061HIGHAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates fEPSS 0.9%CVE-2024-56202MEDIUMApache Traffic Server: Expect header field can unreasonably retain resourceEPSS 0.9%CVE-2022-3281HIGHWAGO: multiple products - Loss of MAC-Address-Filtering after rebootEPSS 0.8%CVE-2024-32971CRITICALDefect in query plan cache may cause incorrect operations to be executed in Apollo RouterEPSS 0.7%CVE-2026-35191LOWQUIC Unvalidated Amplification Credit may be Over AccountedEPSS 0.7%CVE-2026-8806HIGHDenial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet moduleEPSS 0.6%CVE-2026-93675HIGHLangflow OSS is affected by multiple vulnerabilitiesEPSS 0.6%CVE-2024-30246HIGHTuleap deleting or moving an artifact can delete values from unrelated artifactsEPSS 0.6%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.6%CVE-2019-5062HIGHAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 80EPSS 0.6%CVE-2025-46712LOWErlang/OTP SSH Has Strict KEX ViolationsEPSS 0.5%CVE-2023-32732MEDIUMDenial-of-Service in gRPCEPSS 0.5%CVE-2023-32731HIGHInformation leak in gRPCEPSS 0.5%