Falhas do tipo CWE-1287

171 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2026-44249HIGHNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingEPSS 1.0%CVE-2022-43723HIGHA vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software dEPSS 1.0%CVE-2021-20329MEDIUMSpecific cstrings input may not be properly validated in the Go DriverEPSS 0.9%CVE-2023-3917MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.9%CVE-2023-3900MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.9%CVE-2026-24307CRITICALM365 Copilot Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-96044HIGHMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-31948MEDIUMIn FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crashEPSS 0.8%CVE-2024-5594CRITICALOpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arEPSS 0.8%CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.8%CVE-2023-3904MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2025-12977CRITICALCVE-2025-12977EPSS 0.8%CVE-2022-22228HIGHJunos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packetEPSS 0.7%CVE-2024-9404MEDIUMDenial-of-Service VulnerabilityEPSS 0.7%CVE-2026-97801HIGH.NET Framework Tampering VulnerabilityEPSS 0.7%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2024-43426HIGHMoodle: arbitrary file read risk through pdftexEPSS 0.7%CVE-2024-8403HIGHDenial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP ModuleEPSS 0.7%CVE-2021-44694MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.7%CVE-2025-20630MEDIUMMobile crash via object that can't be cast to String in Attachment FieldEPSS 0.6%