Fallos del tipo CWE-472

167 resultados

Estouro de inteiro

Ocorre quando uma operação aritmética com inteiros produz um resultado que ultrapassa o limite máximo (ou mínimo) que o tipo de dado consegue armazenar, causando wrap-around ou truncamento silencioso. Isso permite manipular lógica de validação, contadores e cálculos de tamanho de buffer, abrindo portas para corrupção de memória ou execução arbitrária.

Ejemplo

Um validador de upload verifica se `tamanho_arquivo < INT_MAX` para aceitar o arquivo. Um atacante envia um arquivo com tamanho calculado para, ao ser multiplicado por 2 em um cálculo interno, fazer o inteiro estourar e retornar um valor pequeno, burlando a restrição e causando buffer overflow.

Cómo mitigar

Use tipos com intervalo maior (como uint64_t para cálculos críticos), implemente verificações pré-operação para detectar risco de estouro antes de executar a aritmética, ou utilize bibliotecas seguras que tratam overflows. Em linguagens de alto nível, prefira tipos que crescem automaticamente (BigInteger) ou use saturação em vez de wrap-around.

CVE-2026-5277HIGHInteger overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-10986HIGHInteger overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via aEPSS 0.3%CVE-2026-5870HIGHInteger overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.3%CVE-2026-32699MEDIUMFacturaScripts unauthorized modification of immutable nick field via EditUser controllerEPSS 0.3%CVE-2026-7484MEDIUMImproper Access Control in Abis Technology's AVESİSEPSS 0.3%CVE-2025-25382HIGHAn issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amoEPSS 0.3%CVE-2026-1982MEDIUMPersian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal WidgetEPSS 0.3%CVE-2026-77794MEDIUMRegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero QuantityEPSS 0.3%CVE-2026-15149MEDIUMWP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price ManipulationEPSS 0.3%CVE-2026-85010MEDIUMRestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-onsEPSS 0.3%CVE-2026-16067MEDIUMEvent Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket PriceEPSS 0.3%CVE-2026-13796CRITICALInteger overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process toEPSS 0.3%CVE-2025-43002MEDIUMMissing Authorization check in SAP S4/HANA (OData meta-data property)EPSS 0.3%CVE-2026-34751CRITICALPayload has Unvalidated Input in Password Recovery EndpointsEPSS 0.3%CVE-2026-107636HIGHpH7Builder before 18.5.1 Payment Bypass via Payment Module MainControllerEPSS 0.3%CVE-2026-4911MEDIUMBooking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' ParameterEPSS 0.3%CVE-2026-13801HIGHInteger overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process toEPSS 0.3%CVE-2025-26312MEDIUMSendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.EPSS 0.3%CVE-2025-31333MEDIUMOdata meta-data tampering in SAP S4CORE entityEPSS 0.3%CVE-2026-16089MEDIUMKeycloak-services: keycloak-services: authorization codes can be retargeted to another client sessionEPSS 0.3%