Fallos del tipo CWE-682

76 resultados

Cálculo incorreto

A aplicação realiza um cálculo matemático ou lógico que produz um resultado errado ou inesperado, comprometendo a integridade dos dados ou a segurança da operação. Isso pode ocorrer por erro de lógica, falta de validação de entrada, overflow/underflow, ou operações com tipos de dados incompatíveis.

Ejemplo

Um sistema de e-commerce calcula o preço final usando '(quantidade * preço_unitário) / 100' para aplicar desconto, mas quando quantidade ou preço são muito grandes, ocorre overflow antes da divisão, resultando em um valor final drasticamente menor que o esperado. Um atacante compra itens caros por centavos.

Cómo mitigar

Valide todas as entradas numéricas (faixa, tipo, tamanho), use bibliotecas ou linguagens com validação automática de overflow, implemente testes de casos extremos (valores mínimos, máximos, negativos), e revise a lógica aritmética com atenção especial a ordem de operações e tipos de dados.

CVE-2025-5372MEDIUMLibssh: incorrect return code handling in ssh_kdf() in libsshEPSS 0.5%CVE-2024-34704MEDIUMera-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimizationEPSS 0.5%CVE-2023-31347MEDIUMDue to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when SEPSS 0.5%CVE-2026-10512LOWX25519 x86_64 assembly final reduction leaves non-canonical field elementEPSS 0.5%CVE-2026-16363CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.4%CVE-2023-36980—An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds thEPSS 0.4%CVE-2025-55552MEDIUMpytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.EPSS 0.4%CVE-2026-33487HIGHgoxmldsig has validateSignature Loop Variable Capture Signature BypassEPSS 0.4%CVE-2026-24783HIGHsoroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with NegativesEPSS 0.4%CVE-2026-76043HIGHIncorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox EPSS 0.4%CVE-2026-1229LOWIncorrect calculation in CIRCL secp384r1 CombinedMultEPSS 0.4%CVE-2024-45056MEDIUM`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolcEPSS 0.4%CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%CVE-2026-44074LOWBitwise OR of errno valuesEPSS 0.4%CVE-2024-32873LOWevmos allows transferring unvested tokens after delegationsEPSS 0.4%CVE-2026-44498CRITICALZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsEPSS 0.4%CVE-2026-28410MEDIUMThe Graph: Revocable vesting contracts allows early access to locked tokensEPSS 0.4%CVE-2025-26622LOWsqrt doesn't define rounding behavior in VyperEPSS 0.3%CVE-2024-25883MEDIUMThe mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.EPSS 0.3%