Fallos del tipo CWE-670

119 resultados

Validação inadequada de entrada

Ocorre quando a aplicação não valida ou valida de forma insuficiente dados recebidos de fontes externas (usuário, API, arquivo, rede), permitindo que dados malformados, maliciosos ou inesperados sejam processados. Isso abre porta para injeção, corrupção de lógica e execução de código não autorizado.

Ejemplo

Um formulário web que aceita um campo 'idade' sem verificar se é um número, permite que um atacante envie caracteres especiais ou comandos SQL; ou uma API que recebe um caminho de arquivo sem normalizar ou restringir, deixando vulnerável a path traversal (acesso a arquivos fora do diretório permitido).

Cómo mitigar

Sempre validar entrada no lado do servidor: verificar tipo, comprimento, formato e intervalo esperados. Use listas brancas (whitelist) quando possível, rejeite o que não combina. Combine com sanitização apropriada à saída (escape para HTML, SQL parameterizado, etc.).

CVE-2026-117859MEDIUMKeycloak-services: keycloak-services: par single-use bypass via flow restartEPSS 0.2%CVE-2024-35312MEDIUMIn Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.EPSS 0.2%CVE-2026-41988LOWuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUIDEPSS 0.2%CVE-2024-0313MEDIUMA malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrarEPSS 0.2%CVE-2026-72704MEDIUMRocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After TransportEPSS 0.2%CVE-2026-72703MEDIUMRocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-CallsEPSS 0.2%CVE-2026-72705MEDIUMRocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order ArgumentEPSS 0.2%CVE-2026-40960HIGHLuanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods oEPSS 0.2%CVE-2026-40200HIGHAn issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due toEPSS 0.2%CVE-2026-12321MEDIUMJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.2%CVE-2025-33199LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successfuEPSS 0.1%CVE-2026-73283LOWIn sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.EPSS 0.1%CVE-2023-20915HIGHIn addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due toEPSS 0.1%CVE-2026-107284LOWAsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept checkEPSS 0.1%CVE-2026-35343LOWuutils coreutils cut Inconsistent Output Suppression with Newline DelimitersEPSS 0.1%CVE-2026-106586LOWIn sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a EPSS 0.1%CVE-2026-41527MEDIUMKDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the meEPSS 0.1%CVE-2022-26461MEDIUMIn vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2026-20713MEDIUMAlways-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. SysEPSS 0.1%