Fallos del tipo CWE-440

41 resultados

Violação de Comportamento Esperado

É quando o software faz algo diferente do que deveria fazer conforme sua especificação ou contrato — seja por lógica errada, tratamento inadequado de casos extremos ou falha em validações críticas. O perigo está em que a aplicação pode se comportar de forma impredizível em produção, abrindo brechas para exploração ou corrupção de dados.

Ejemplo

Um sistema bancário que deveria rejeitar transações acima de um limite diário, mas por erro de lógica as aprova mesmo assim. Ou um controle de acesso que deixa passar permissões quando a validação falha, em vez de negar por padrão.

Cómo mitigar

Implemente testes unitários e de integração que cubram comportamentos esperados e casos extremos; use especificações formais ou contratos (como assertions) no código; revise lógica condicional crítica em code review focando em 'o que deveria acontecer aqui?'.

CVE-2019-5108HIGHAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerabilitEPSS 10.1%CVE-2023-6129MEDIUMPOLY1305 MAC implementation corrupts vector registers on PowerPCEPSS 2.3%CVE-2021-41035—In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methEPSS 1.7%CVE-2018-12550—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only commeEPSS 1.4%CVE-2019-6569—The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.EPSS 1.3%CVE-2023-2088MEDIUMA flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A rEPSS 1.2%CVE-2019-5061HIGHAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates fEPSS 0.9%CVE-2023-4807HIGHPOLY1305 MAC implementation corrupts XMM registers on WindowsEPSS 0.9%CVE-2024-56202MEDIUMApache Traffic Server: Expect header field can unreasonably retain resourceEPSS 0.8%CVE-2024-32971CRITICALDefect in query plan cache may cause incorrect operations to be executed in Apollo RouterEPSS 0.7%CVE-2022-3281HIGHWAGO: multiple products - Loss of MAC-Address-Filtering after rebootEPSS 0.7%CVE-2026-8806HIGHDenial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet moduleEPSS 0.6%CVE-2024-30246HIGHTuleap deleting or moving an artifact can delete values from unrelated artifactsEPSS 0.6%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.6%CVE-2019-5062HIGHAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 80EPSS 0.5%CVE-2023-32732MEDIUMDenial-of-Service in gRPCEPSS 0.5%CVE-2023-32731HIGHInformation leak in gRPCEPSS 0.5%CVE-2025-46712LOWErlang/OTP SSH Has Strict KEX ViolationsEPSS 0.5%CVE-2020-10766MEDIUMA logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker withEPSS 0.5%CVE-2025-8850LOWInsecure API Design in danny-avila/librechatEPSS 0.4%