Falhas do tipo CWE-1286

109 resultados

Validação Inadequada da Sintaxe de Entrada

A aplicação aceita entrada do usuário sem validar corretamente se ela segue a sintaxe esperada, permitindo dados malformados ou injetados chegarem até o processamento. Isso abre caminho para injeção de código, parsing incorreto ou comportamento imprevisto, já que o sistema assume que a entrada é segura sem verificar sua estrutura.

Exemplo

Um formulário recebe uma data que deveria estar em formato DD/MM/AAAA, mas aceita qualquer string sem validar — como '32/13/abc' ou ''; e'; DROP TABLE users; --'. O backend processa isso diretamente sem checar sintaxe, causando erros lógicos ou injeção SQL.

Como mitigar

Implemente validação de entrada no lado servidor antes de qualquer processamento: verifique formato (regex, parser dedicado), tipos de dados, comprimento e caracteres permitidos. Use bibliotecas de parsing que rejeitam entrada malformada, nunca confie em validação frontend.

CVE-2026-0663MEDIUMDenial of Service condition in M-Files ServerEPSS 0.4%CVE-2026-67418MEDIUMRabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribersEPSS 0.4%CVE-2026-6442HIGHImproper Command Detection Logic Allows RCE in Cortex Code Command-Line InterfaceEPSS 0.4%CVE-2024-6173MEDIUM51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowEPSS 0.4%CVE-2026-87080CRITICALNet::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycodeEPSS 0.4%CVE-2025-24345MEDIUMA vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mEPSS 0.4%CVE-2025-8873HIGHArista EOS Dataplane Denial of Service via Malformed IPsec PacketEPSS 0.4%CVE-2025-30415HIGHDenial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.4%CVE-2025-20644MEDIUMIn Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has coEPSS 0.4%CVE-2025-46419MEDIUMWestermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.EPSS 0.4%CVE-2022-22176HIGHJunos OS: In a scenario with dhcp-security and option-82 configured jdhcpd crashes upon receipt of a malformed DHCP packetEPSS 0.4%CVE-2026-111107HIGHFireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of ServiceEPSS 0.4%CVE-2026-20114MEDIUMA vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to eEPSS 0.4%CVE-2026-50131HIGHFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 rangesEPSS 0.4%CVE-2026-33778HIGHJunos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashesEPSS 0.3%CVE-2026-100902HIGHBarco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of inputEPSS 0.3%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.3%CVE-2026-88260HIGHAuthentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in BrainzcoEPSS 0.3%CVE-2026-40198HIGHNet::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypassEPSS 0.3%CVE-2026-83728HIGHWindows Hyper-V Spoofing VulnerabilityEPSS 0.3%