Fallos del tipo CWE-92

34 resultados

Verificação inadequada de condições

É quando o código falha em validar corretamente as condições necessárias antes de executar uma operação crítica — por exemplo, checar se um usuário tem permissão, se um valor está no intervalo esperado, ou se um recurso existe. O problema é que lógica de validação incompleta ou incorreta permite que o programa execute ações que não deveria, expondo funcionalidades ou dados sensíveis.

Ejemplo

Um sistema de compras que verifica se o usuário tem saldo, mas não valida se a quantidade de itens no carrinho é válida ou se o preço foi modificado pelo cliente no frontend. Um atacante altera a requisição e completa a compra com valores falsos.

Cómo mitigar

Sempre validar **todas** as condições relevantes no servidor, nunca confiar em verificações do cliente. Use lógica explícita: whitelist o que é permitido, não blacklist o que é proibido. Implemente testes automatizados que cobram casos extremos e tentativas de bypass.

CVE-2022-43507HIGHImproper buffer restrictions in the Intel(R) QAT Engine for OpenSSL before version 0.6.16 may allow a privileged user to potentially enable EPSS 0.6%CVE-2023-38655MEDIUMImproper buffer restrictions in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentiallEPSS 0.5%CVE-2023-47169LOWImproper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of serEPSS 0.3%CVE-2024-23918HIGHImproper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privilegedEPSS 0.3%CVE-2023-45845MEDIUMImproper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to pEPSS 0.2%CVE-2023-47165MEDIUMImproper conditions check in the Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow an privileged user to potentially enabEPSS 0.2%CVE-2022-41808LOWImproper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to poteEPSS 0.2%CVE-2023-22390MEDIUMImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-22313LOWImproper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable EPSS 0.2%CVE-2022-29262HIGHImproper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of priEPSS 0.2%CVE-2023-27300LOWImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-27307LOWImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to pEPSS 0.2%CVE-2023-27308MEDIUMImproper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potenEPSS 0.2%CVE-2023-40220MEDIUMImproper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure viaEPSS 0.2%CVE-2023-25545HIGHImproper buffer restrictions in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalationEPSS 0.2%CVE-2024-21809MEDIUMImproper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated useEPSS 0.2%CVE-2022-29510HIGHImproper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to potenEPSS 0.2%CVE-2023-27504HIGHImproper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.2%CVE-2023-30767MEDIUMImproper buffer restrictions in Intel(R) Optimization for TensorFlow before version 2.13.0 may allow an authenticated user to potentially enEPSS 0.2%CVE-2023-28383MEDIUMImproper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalation of privilege via EPSS 0.2%