Fallos del tipo CWE-670

119 resultados

Validação inadequada de entrada

Ocorre quando a aplicação não valida ou valida de forma insuficiente dados recebidos de fontes externas (usuário, API, arquivo, rede), permitindo que dados malformados, maliciosos ou inesperados sejam processados. Isso abre porta para injeção, corrupção de lógica e execução de código não autorizado.

Ejemplo

Um formulário web que aceita um campo 'idade' sem verificar se é um número, permite que um atacante envie caracteres especiais ou comandos SQL; ou uma API que recebe um caminho de arquivo sem normalizar ou restringir, deixando vulnerável a path traversal (acesso a arquivos fora do diretório permitido).

Cómo mitigar

Sempre validar entrada no lado do servidor: verificar tipo, comprimento, formato e intervalo esperados. Use listas brancas (whitelist) quando possível, rejeite o que não combina. Combine com sanitização apropriada à saída (escape para HTML, SQL parameterizado, etc.).

CVE-2026-7656HIGHBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackEPSS 0.3%CVE-2025-24800CRITICALCritical vulnerability in `ismp-grandpa` <v15.0.1EPSS 0.3%CVE-2026-109722HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2024-5659HIGHRockwell Automation Multicast Request Causes major nonrecoverable fault on Select ControllersEPSS 0.3%CVE-2026-6608MEDIUMlm-sys fastchat Arena Side-by-Side View add_text control flowEPSS 0.3%CVE-2026-40942MEDIUMDSF: Inverted Time Comparison in OIDC JWKS and Token CacheEPSS 0.3%CVE-2026-73468HIGHSecurity Advisory 0175EPSS 0.3%CVE-2026-56307MEDIUMCap-go - Broken Cursor Pagination in /private/devices EndpointEPSS 0.3%CVE-2023-20921HIGHIn onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logicEPSS 0.3%CVE-2024-30133MEDIUMHCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerabilityEPSS 0.3%CVE-2024-47763MEDIUMWasmtime runtime crash when combining tail calls with trapping importsEPSS 0.2%CVE-2026-35387LOWOpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgoEPSS 0.2%CVE-2025-32942HIGHSSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.EPSS 0.2%CVE-2026-102110MEDIUMMissing authentication on a Kiteworks appliance setup functionEPSS 0.2%CVE-2026-40394MEDIUMVarnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certEPSS 0.2%CVE-2026-14935LOWGstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence checkEPSS 0.2%CVE-2026-35414MEDIUMOpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with aEPSS 0.2%CVE-2026-44928LOWIn uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.EPSS 0.2%CVE-2026-102124MEDIUMKiteworks Core Missing Authentication for Critical FunctionEPSS 0.2%CVE-2024-53134MEDIUMpmdomain: imx93-blk-ctrl: correct remove pathEPSS 0.2%