Falhas do tipo CWE-1284

324 resultados

Validação inadequada de quantidade em entrada

Ocorre quando o software aceita entrada do usuário que especifica uma quantidade (número de items, tamanho de buffer, contagem de loops, etc.) sem validar se esse valor está dentro dos limites esperados. Um atacante pode fornecer uma quantidade excessiva, nula ou negativa, causando alocação de memória descontrolada, loops infinitos, underflow ou acesso a dados não inicializados.

Exemplo

Um serviço web recebe um parâmetro 'quantidade_registros' para retornar dados. Se não validar o valor, um atacante envia quantidade_registros=999999999, forçando alocação massiva de memória e negação de serviço; ou envia -1 e o código interpreta como unsigned, provocando comportamento inesperado.

Como mitigar

Valide explicitamente toda entrada que represente uma quantidade: defina limites mínimo e máximo aceitáveis, rejeite valores fora do intervalo, e use tipos numéricos apropriados (prefira unsigned para contagens, com overflow checks). Teste casos extremos (zero, negativo, muito grande).

CVE-2024-9369HIGHInsufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer procEPSS 0.7%CVE-2025-33211HIGHNVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. AEPSS 0.7%CVE-2022-39272MEDIUMFlux2 vulnerable to Denial of Service due to Improper use of metav1.DurationEPSS 0.7%CVE-2023-23549LOWDoS via long hostnamesEPSS 0.6%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.6%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.6%CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 0.6%CVE-2026-59252HIGHMissing gas_limit validation in mpp Tempo fee-payer enables wallet drainEPSS 0.6%CVE-2025-32415LOWIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploitEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2022-0596MEDIUMImproper Validation of Specified Quantity in Input in microweber/microweberEPSS 0.6%CVE-2026-54234HIGHvLLM: Remote DoS in vLLM via Invalid Recovered Token ReinjectionEPSS 0.6%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2025-2826LOWn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.EPSS 0.6%CVE-2025-12664HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2024-24690MEDIUMZoom Clients - Improper Input ValidationEPSS 0.6%CVE-2024-9448HIGHOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be droppEPSS 0.6%CVE-2024-7316MEDIUMDenial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesEPSS 0.6%CVE-2025-15080HIGHInformation Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA productsEPSS 0.6%CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%