Falhas do tipo CWE-1284

387 resultados

Validação inadequada de quantidade em entrada

Ocorre quando o software aceita entrada do usuário que especifica uma quantidade (número de items, tamanho de buffer, contagem de loops, etc.) sem validar se esse valor está dentro dos limites esperados. Um atacante pode fornecer uma quantidade excessiva, nula ou negativa, causando alocação de memória descontrolada, loops infinitos, underflow ou acesso a dados não inicializados.

Exemplo

Um serviço web recebe um parâmetro 'quantidade_registros' para retornar dados. Se não validar o valor, um atacante envia quantidade_registros=999999999, forçando alocação massiva de memória e negação de serviço; ou envia -1 e o código interpreta como unsigned, provocando comportamento inesperado.

Como mitigar

Valide explicitamente toda entrada que represente uma quantidade: defina limites mínimo e máximo aceitáveis, rejeite valores fora do intervalo, e use tipos numéricos apropriados (prefira unsigned para contagens, com overflow checks). Teste casos extremos (zero, negativo, muito grande).

CVE-2026-19026MEDIUMNbit filter NULL/short parameter-array dereferenceEPSS 0.2%CVE-2024-53879LOWNVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a maEPSS 0.2%CVE-2026-59930MEDIUMMistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` contentEPSS 0.2%CVE-2025-68383MEDIUMFilebeat Improper Validation of Specified Index, Position, or Offset in InputEPSS 0.2%CVE-2026-82734LOWNon-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.DecimalEPSS 0.2%CVE-2024-45351HIGHGame center application has code execution VulnerabilityEPSS 0.2%CVE-2024-21953MEDIUMImproper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integriEPSS 0.2%CVE-2026-97275MEDIUMWordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2025-3756HIGHDenial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850EPSS 0.2%CVE-2026-82752MEDIUMAsh string length constraints count graphemes, so a combining-mark string of any size passes max_lengthEPSS 0.2%CVE-2026-106605MEDIUMWordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerabilityEPSS 0.2%CVE-2025-11743HIGHRockwell Automation CompactLogix® 5370 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-53720MEDIUMpymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too smallEPSS 0.2%CVE-2026-123011MEDIUMSTMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.EPSS 0.2%CVE-2026-59997MEDIUMinternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-lEPSS 0.2%CVE-2022-20491HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.2%CVE-2023-20582MEDIUMImproper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults EPSS 0.2%CVE-2022-20543LOWIn multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service wEPSS 0.2%CVE-2024-3185MEDIUMRapid7 Insight Agent Sensitive Key Exposed To Local UsersEPSS 0.2%CVE-2026-2403MEDIUMCWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting loEPSS 0.2%