Fallos del tipo CWE-472

154 resultados

Estouro de inteiro

Ocorre quando uma operação aritmética com inteiros produz um resultado que ultrapassa o limite máximo (ou mínimo) que o tipo de dado consegue armazenar, causando wrap-around ou truncamento silencioso. Isso permite manipular lógica de validação, contadores e cálculos de tamanho de buffer, abrindo portas para corrupção de memória ou execução arbitrária.

Ejemplo

Um validador de upload verifica se `tamanho_arquivo < INT_MAX` para aceitar o arquivo. Um atacante envia um arquivo com tamanho calculado para, ao ser multiplicado por 2 em um cálculo interno, fazer o inteiro estourar e retornar um valor pequeno, burlando a restrição e causando buffer overflow.

Cómo mitigar

Use tipos com intervalo maior (como uint64_t para cálculos críticos), implemente verificações pré-operação para detectar risco de estouro antes de executar a aritmética, ou utilize bibliotecas seguras que tratam overflows. Em linguagens de alto nível, prefira tipos que crescem automaticamente (BigInteger) ou use saturação em vez de wrap-around.

CVE-2021-27770MEDIUMHCL Sametime is vulnerable to arbitrary HTTP requestsEPSS 0.7%CVE-2024-7025HIGHInteger overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crEPSS 0.7%CVE-2024-3649MEDIUMContact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price ManipulationEPSS 0.7%CVE-2026-2649HIGHInteger overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.7%CVE-2026-65052HIGHNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsEPSS 0.6%CVE-2023-28512MEDIUMIBM Watson CP4D Data Stores improper input validationEPSS 0.5%CVE-2025-3530HIGHWordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price ManipulationEPSS 0.5%CVE-2025-47817HIGHIn BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.EPSS 0.5%CVE-2026-3538HIGHInteger overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acceEPSS 0.5%CVE-2025-29788MEDIUMSylius PayPal Plugin Payment Amount Manipulation VulnerabilityEPSS 0.5%CVE-2025-47245HIGHIn BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.EPSS 0.5%CVE-2024-50703MEDIUMTeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.EPSS 0.5%CVE-2026-3536HIGHInteger overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory accEPSS 0.5%CVE-2025-43930CRITICALHashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the EPSS 0.5%CVE-2026-2519MEDIUMOnline Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'EPSS 0.5%CVE-2025-66385CRITICALUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a highEPSS 0.4%CVE-2024-6010MEDIUMCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price ManipulationEPSS 0.4%CVE-2025-22384HIGHAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the CEPSS 0.4%CVE-2026-5274HIGHInteger overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted EPSS 0.4%CVE-2026-14430HIGHInteger overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%