Falhas do tipo CWE-1287

160 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2025-20033MEDIUMDoS via custom post type for sysconsole plugin readersEPSS 0.6%CVE-2025-20630MEDIUMMobile crash via object that can't be cast to String in Attachment FieldEPSS 0.6%CVE-2024-54083MEDIUMDoS via lack of type validation in CallsEPSS 0.6%CVE-2026-55124MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-48858HIGHVulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development PlatformEPSS 0.6%CVE-2025-20088MEDIUMInsufficient Input Validation on Post PropsEPSS 0.6%CVE-2026-4598HIGHVersions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInEPSS 0.5%CVE-2026-29645HIGHNEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decodeEPSS 0.5%CVE-2024-30395HIGHJunos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashEPSS 0.5%CVE-2024-48851HIGHRemote Code ExecutionEPSS 0.5%CVE-2026-18830HIGHInsufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness APIEPSS 0.5%CVE-2025-20036MEDIUMInsufficient Input Validation on Post PropsEPSS 0.5%CVE-2025-21083MEDIUMInsufficient Input Validation on Post PropsEPSS 0.5%CVE-2024-35213CRITICALVulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)EPSS 0.5%CVE-2024-20494HIGHA vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefenseEPSS 0.5%CVE-2026-21932HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JaEPSS 0.5%CVE-2025-20244HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access VPN Web Server Denial of Service VulnerabilityEPSS 0.5%CVE-2025-41650HIGHWeidmueller: Denial-of-Service Vulnerability in Industrial Ethernet SwitchesEPSS 0.5%CVE-2025-24876HIGHAuthentication bypass via authorization code injection in SAP ApprouterEPSS 0.5%CVE-2025-41395MEDIUMWebapp DoS via malicious retrospective post in PlaybooksEPSS 0.5%