Fallos del tipo CWE-472

154 resultados

Estouro de inteiro

Ocorre quando uma operação aritmética com inteiros produz um resultado que ultrapassa o limite máximo (ou mínimo) que o tipo de dado consegue armazenar, causando wrap-around ou truncamento silencioso. Isso permite manipular lógica de validação, contadores e cálculos de tamanho de buffer, abrindo portas para corrupção de memória ou execução arbitrária.

Ejemplo

Um validador de upload verifica se `tamanho_arquivo < INT_MAX` para aceitar o arquivo. Um atacante envia um arquivo com tamanho calculado para, ao ser multiplicado por 2 em um cálculo interno, fazer o inteiro estourar e retornar um valor pequeno, burlando a restrição e causando buffer overflow.

Cómo mitigar

Use tipos com intervalo maior (como uint64_t para cálculos críticos), implemente verificações pré-operação para detectar risco de estouro antes de executar a aritmética, ou utilize bibliotecas seguras que tratam overflows. Em linguagens de alto nível, prefira tipos que crescem automaticamente (BigInteger) ou use saturação em vez de wrap-around.

CVE-2025-0436HIGHInteger overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.4%CVE-2025-3743MEDIUMUpsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order ManipulationEPSS 0.4%CVE-2026-59817MEDIUMGhost: Paid gift memberships obtainable at minimal cost via the donations featureEPSS 0.4%CVE-2025-67846MEDIUMThe Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgradEPSS 0.4%CVE-2023-38520MEDIUMWordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter TamperingEPSS 0.4%CVE-2026-56877MEDIUMThe SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter aEPSS 0.4%CVE-2025-27893LOWIn Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such aEPSS 0.4%CVE-2024-9123HIGHInteger overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crEPSS 0.4%CVE-2024-12123MEDIUMUnauthorized Modification of Ticket RequesterEPSS 0.4%CVE-2025-43933CRITICALfblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends EPSS 0.4%CVE-2025-59382LOWQTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)EPSS 0.4%CVE-2026-10987HIGHInteger overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2026-10963HIGHInteger overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2026-10965HIGHInteger overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox viEPSS 0.4%CVE-2026-10964HIGHInteger overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2025-30236HIGHShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) EPSS 0.4%CVE-2025-14750HIGHExternal Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb ServiceEPSS 0.4%CVE-2023-24373LOWWordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerabilityEPSS 0.4%CVE-2026-5859HIGHInteger overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.4%CVE-2026-3914HIGHInteger overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.3%