Falhas do tipo CWE-1286

95 resultados

Validação Inadequada da Sintaxe de Entrada

A aplicação aceita entrada do usuário sem validar corretamente se ela segue a sintaxe esperada, permitindo dados malformados ou injetados chegarem até o processamento. Isso abre caminho para injeção de código, parsing incorreto ou comportamento imprevisto, já que o sistema assume que a entrada é segura sem verificar sua estrutura.

Exemplo

Um formulário recebe uma data que deveria estar em formato DD/MM/AAAA, mas aceita qualquer string sem validar — como '32/13/abc' ou ''; e'; DROP TABLE users; --'. O backend processa isso diretamente sem checar sintaxe, causando erros lógicos ou injeção SQL.

Como mitigar

Implemente validação de entrada no lado servidor antes de qualquer processamento: verifique formato (regex, parser dedicado), tipos de dados, comprimento e caracteres permitidos. Use bibliotecas de parsing que rejeitam entrada malformada, nunca confie em validação frontend.

CVE-2025-54995MEDIUMAsterisk remotely exploitable leak of RTP UDP ports and internal resourcesEPSS 0.5%CVE-2025-24346HIGHA vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maEPSS 0.5%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2025-0638HIGHRoutinator crashes when illegal characters are present in manifest file namesEPSS 0.5%CVE-2024-39542HIGHJunos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashEPSS 0.5%CVE-2024-52362MEDIUMIBM App Connect Enterprise Certified Container denial of serviceEPSS 0.5%CVE-2026-57026HIGHJunos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashEPSS 0.5%CVE-2025-10954MEDIUMVersions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of InputEPSS 0.5%CVE-2024-8772MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition EPSS 0.4%CVE-2025-11573HIGHDenial of Service issue in Amazon.IonDotnetEPSS 0.4%CVE-2026-21917HIGHJunos OS: SRX Series: Specifically malformed SSL packet causes FPC crashEPSS 0.4%CVE-2026-0663MEDIUMDenial of Service condition in M-Files ServerEPSS 0.4%CVE-2024-6173MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowEPSS 0.4%CVE-2025-8873HIGHArista EOS Dataplane Denial of Service via Malformed IPsec PacketEPSS 0.4%CVE-2025-20644MEDIUMIn Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has coEPSS 0.4%CVE-2025-30415HIGHDenial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.4%CVE-2022-22176HIGHJunos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packetEPSS 0.4%CVE-2025-24345MEDIUMA vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mEPSS 0.4%CVE-2026-72916MEDIUMMastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesEPSS 0.4%CVE-2026-6442HIGHImproper Command Detection Logic Allows RCE in Cortex Code Command-Line InterfaceEPSS 0.4%