Fallos del tipo CWE-670

110 resultados

Validação inadequada de entrada

Ocorre quando a aplicação não valida ou valida de forma insuficiente dados recebidos de fontes externas (usuário, API, arquivo, rede), permitindo que dados malformados, maliciosos ou inesperados sejam processados. Isso abre porta para injeção, corrupção de lógica e execução de código não autorizado.

Ejemplo

Um formulário web que aceita um campo 'idade' sem verificar se é um número, permite que um atacante envie caracteres especiais ou comandos SQL; ou uma API que recebe um caminho de arquivo sem normalizar ou restringir, deixando vulnerável a path traversal (acesso a arquivos fora do diretório permitido).

Cómo mitigar

Sempre validar entrada no lado do servidor: verificar tipo, comprimento, formato e intervalo esperados. Use listas brancas (whitelist) quando possível, rejeite o que não combina. Combine com sanitização apropriada à saída (escape para HTML, SQL parameterizado, etc.).

CVE-2022-29609MEDIUMAn issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rEPSS 0.6%CVE-2022-31017LOWExpression Always True vulnerability in Zulip ServerEPSS 0.6%CVE-2024-45311HIGHDenial of service in quinn-proto when using `Endpoint::retry()`EPSS 0.6%CVE-2024-35190MEDIUMAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsEPSS 0.6%CVE-2026-55276CRITICALApache Tomcat: Logged effective web.xml is incompleteEPSS 0.6%CVE-2022-2993HIGHbt: host: Wrong key validation checkEPSS 0.6%CVE-2023-32675LOWNonpayable default functions are sometimes payable in vyperEPSS 0.6%CVE-2023-49798MEDIUMDuplicated execution of subcalls in OpenZeppelin ContractsEPSS 0.5%CVE-2023-41052LOWVyper: incorrect order of evaluation of side effects for some builtinsEPSS 0.5%CVE-2024-45807HIGHoghttp2 crash on OnBeginHeadersForStream in envoyEPSS 0.5%CVE-2023-40015LOWVyper: reversed order of side effects for some operationsEPSS 0.5%CVE-2024-45304MEDIUMOwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contractsEPSS 0.5%CVE-2025-29312CRITICALAn issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link tEPSS 0.5%CVE-2021-43819HIGHStargate-Bukkit improperly handles vehicles causing data duplication.EPSS 0.5%CVE-2026-20171MEDIUMCisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service VulnerabilityEPSS 0.5%CVE-2024-25622LOWH2O ignores headers configuration directivesEPSS 0.5%CVE-2025-32996MEDIUMIn http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.EPSS 0.5%CVE-2026-1874HIGHDenial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet moduleEPSS 0.4%CVE-2026-19487MEDIUMPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclassEPSS 0.4%CVE-2022-25745CRITICALAlways Incorrect Control Flow Implementation in MODEMEPSS 0.4%