Fallos del tipo CWE-670

101 resultados

Validação inadequada de entrada

Ocorre quando a aplicação não valida ou valida de forma insuficiente dados recebidos de fontes externas (usuário, API, arquivo, rede), permitindo que dados malformados, maliciosos ou inesperados sejam processados. Isso abre porta para injeção, corrupção de lógica e execução de código não autorizado.

Ejemplo

Um formulário web que aceita um campo 'idade' sem verificar se é um número, permite que um atacante envie caracteres especiais ou comandos SQL; ou uma API que recebe um caminho de arquivo sem normalizar ou restringir, deixando vulnerável a path traversal (acesso a arquivos fora do diretório permitido).

Cómo mitigar

Sempre validar entrada no lado do servidor: verificar tipo, comprimento, formato e intervalo esperados. Use listas brancas (whitelist) quando possível, rejeite o que não combina. Combine com sanitização apropriada à saída (escape para HTML, SQL parameterizado, etc.).

CVE-2026-38361HIGHMultiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_EPSS 2.6%CVE-2020-1914—A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fEPSS 2.5%CVE-2022-31116HIGHIncorrect handling of invalid surrogate pair characters in ujsonEPSS 2.3%CVE-2021-1236MEDIUMMultiple Cisco Products Snort Application Detection Engine Policy Bypass VulnerabilityEPSS 2.1%CVE-2022-31111MEDIUMDiscrepency in transfer value and actual value due to incorrect truncation in FrontierEPSS 1.3%CVE-2021-43839HIGHDrainage of FeeCollector's Block Transaction FeesEPSS 1.3%CVE-2022-29255HIGHMultiple evaluation of contract address in call in vyperEPSS 1.3%CVE-2023-1668HIGHA flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action mEPSS 1.2%CVE-2022-21655HIGHIncorrect handling of internal redirects results in crash in EnvoyEPSS 1.1%CVE-2022-21679MEDIUMAuthorization Policy bypass in IstioEPSS 1.1%CVE-2024-38365HIGHbtcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionalityEPSS 1.0%CVE-2021-0273MEDIUMJunos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.EPSS 1.0%CVE-2021-41153HIGHSpecification non-compliance in JUMPIEPSS 1.0%CVE-2022-26890HIGHOn F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.EPSS 0.9%CVE-2024-33431MEDIUMAn issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.EPSS 0.9%CVE-2023-30629HIGHVyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success valueEPSS 0.9%CVE-2025-43359CRITICALA logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS SeqEPSS 0.9%CVE-2022-35917MEDIUMWeakness in Transfer Validation Logic in @solana/payEPSS 0.8%CVE-2024-52811HIGHAcks not validated before logged to qlog leads to buffer overflow in ngtcp2EPSS 0.8%CVE-2022-45196HIGHHyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the samEPSS 0.8%