Fallos del tipo CWE-472

167 resultados

Estouro de inteiro

Ocorre quando uma operação aritmética com inteiros produz um resultado que ultrapassa o limite máximo (ou mínimo) que o tipo de dado consegue armazenar, causando wrap-around ou truncamento silencioso. Isso permite manipular lógica de validação, contadores e cálculos de tamanho de buffer, abrindo portas para corrupção de memória ou execução arbitrária.

Ejemplo

Um validador de upload verifica se `tamanho_arquivo < INT_MAX` para aceitar o arquivo. Um atacante envia um arquivo com tamanho calculado para, ao ser multiplicado por 2 em um cálculo interno, fazer o inteiro estourar e retornar um valor pequeno, burlando a restrição e causando buffer overflow.

Cómo mitigar

Use tipos com intervalo maior (como uint64_t para cálculos críticos), implemente verificações pré-operação para detectar risco de estouro antes de executar a aritmética, ou utilize bibliotecas seguras que tratam overflows. Em linguagens de alto nível, prefira tipos que crescem automaticamente (BigInteger) ou use saturação em vez de wrap-around.

CVE-2026-77470HIGHLychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST requestEPSS 0.5%CVE-2025-66385CRITICALUsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a highEPSS 0.5%CVE-2026-5274HIGHInteger overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted EPSS 0.4%CVE-2026-77999HIGHJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.4%CVE-2026-82189HIGHJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.4%CVE-2025-43933CRITICALfblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends EPSS 0.4%CVE-2025-22384HIGHAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the CEPSS 0.4%CVE-2024-6010MEDIUMCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price ManipulationEPSS 0.4%CVE-2026-7571HIGHKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataEPSS 0.4%CVE-2026-14430HIGHInteger overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crEPSS 0.4%CVE-2025-3743MEDIUMUpsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order ManipulationEPSS 0.4%CVE-2026-3914HIGHInteger overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.4%CVE-2026-59817MEDIUMGhost: Paid gift memberships obtainable at minimal cost via the donations featureEPSS 0.4%CVE-2025-27893LOWIn Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such aEPSS 0.4%CVE-2023-38520MEDIUMWordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter TamperingEPSS 0.4%CVE-2025-67846MEDIUMThe Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgradEPSS 0.4%CVE-2025-54832MEDIUMOPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modificationEPSS 0.4%CVE-2026-56877MEDIUMThe SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter aEPSS 0.4%CVE-2026-13841HIGHInteger overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.4%CVE-2025-8198HIGHMinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price ManipulationEPSS 0.4%