Fallos del tipo CWE-617

556 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2026-20422MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.2%CVE-2024-7138MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.2%CVE-2025-48020MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2026-73438HIGHSecurity Advisory 0172EPSS 0.2%CVE-2025-52958MEDIUMJunos OS and Junos OS Evolved: When route validation is enabled, BGP connection establishment failure causes RPD crashEPSS 0.2%CVE-2024-34034MEDIUMAn issue was discovered in FlexRIC 2.0.0. It crashes during a Subscription Request denial-of-service (DoS) attack, triggered by an assertionEPSS 0.2%CVE-2024-34035MEDIUMAn issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with EPSS 0.2%CVE-2026-9825LOWIBM Cyber Fraud Reachable AssertionEPSS 0.2%CVE-2026-34066MEDIUMnimiq-blockchain: Peer-triggerable panic during history syncEPSS 0.2%CVE-2026-8843HIGHCalling createIndex with certain index types can crash mongodEPSS 0.2%CVE-2021-41200MEDIUMIncomplete validation in `tf.summary.create_file_writer`EPSS 0.2%CVE-2025-27073HIGHReachable Assertion in WLAN FirmwareEPSS 0.2%CVE-2025-6952MEDIUMOpen5GS AMF Service amf-sm.c amf_state_operational assertionEPSS 0.2%CVE-2026-96299HIGHMissing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of ServiceEPSS 0.2%CVE-2026-104005HIGHIncorrect authorization in MongoDB Server router for bulk writes to system namespacesEPSS 0.2%CVE-2025-6273MEDIUMWebAssembly wabt binary-reader-objdump.cc LogOpcode assertionEPSS 0.2%CVE-2025-12131MEDIUMTruncated 802.15.4 packet leads to denial of serviceEPSS 0.2%CVE-2026-121406MEDIUMFreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX PayloadEPSS 0.2%CVE-2026-46542MEDIUMnimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointsEPSS 0.2%CVE-2025-48019MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%