Fallos del tipo CWE-670

110 resultados

Validação inadequada de entrada

Ocorre quando a aplicação não valida ou valida de forma insuficiente dados recebidos de fontes externas (usuário, API, arquivo, rede), permitindo que dados malformados, maliciosos ou inesperados sejam processados. Isso abre porta para injeção, corrupção de lógica e execução de código não autorizado.

Ejemplo

Um formulário web que aceita um campo 'idade' sem verificar se é um número, permite que um atacante envie caracteres especiais ou comandos SQL; ou uma API que recebe um caminho de arquivo sem normalizar ou restringir, deixando vulnerável a path traversal (acesso a arquivos fora do diretório permitido).

Cómo mitigar

Sempre validar entrada no lado do servidor: verificar tipo, comprimento, formato e intervalo esperados. Use listas brancas (whitelist) quando possível, rejeite o que não combina. Combine com sanitização apropriada à saída (escape para HTML, SQL parameterizado, etc.).

CVE-2022-35917MEDIUMWeakness in Transfer Validation Logic in @solana/payEPSS 0.8%CVE-2021-34767HIGHCisco IOS XE Software for Catalyst 9800 Series Wireless Controllers IPv6 Denial of Service VulnerabilityEPSS 0.8%CVE-2023-41058HIGHTrigger `beforeFind` not invoked in internal query pipeline in parse-serverEPSS 0.8%CVE-2024-32971CRITICALDefect in query plan cache may cause incorrect operations to be executed in Apollo RouterEPSS 0.7%CVE-2021-32684MEDIUMMissing Handler in @scandipwa/magento-scriptsEPSS 0.7%CVE-2024-53270HIGHHTTP/1: sending overload crashes when the request is reset beforehand in envoyEPSS 0.7%CVE-2024-53269MEDIUMHappy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoyEPSS 0.7%CVE-2025-58136HIGHApache Traffic Server: A simple legitimate POST request causes a crashEPSS 0.7%CVE-2022-29607HIGHAn issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state EPSS 0.7%CVE-2025-49091HIGHKDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a sEPSS 0.7%CVE-2023-20558HIGH Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to EPSS 0.7%CVE-2023-23623HIGHContent-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in ElectronEPSS 0.7%CVE-2022-29605HIGHAn issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that dEPSS 0.7%CVE-2023-41338MEDIUMVulnerability in Ctx.IsFromLocal() in gofiberEPSS 0.7%CVE-2025-21607LOWSuccess of Certain Precompile Calls not Checked in VyperEPSS 0.7%CVE-2026-53404HIGHApache Tomcat: Bad ornext processing in RewriteValveEPSS 0.6%CVE-2024-53271HIGHHTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoyEPSS 0.6%CVE-2024-30246HIGHTuleap deleting or moving an artifact can delete values from unrelated artifactsEPSS 0.6%CVE-2024-37153HIGHEvmos's contract balance not updating correctly after interchain transactionEPSS 0.6%CVE-2022-39354MEDIUMevm has incorrect is_static parameter for custom stateful precompilesEPSS 0.6%