Falhas do tipo CWE-1287

171 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2026-21932HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JaEPSS 0.5%CVE-2025-41650HIGHWeidmueller: Denial-of-Service Vulnerability in Industrial Ethernet SwitchesEPSS 0.5%CVE-2024-20494HIGHA vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefenseEPSS 0.5%CVE-2024-35213CRITICALVulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)EPSS 0.5%CVE-2026-18830HIGHInsufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness APIEPSS 0.5%CVE-2026-9390CRITICALXML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupEPSS 0.5%CVE-2025-41395MEDIUMWebapp DoS via malicious retrospective post in PlaybooksEPSS 0.5%CVE-2025-24876HIGHAuthentication bypass via authorization code injection in SAP ApprouterEPSS 0.5%CVE-2026-44935CRITICALRancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerEPSS 0.5%CVE-2026-87012MEDIUMOpen WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueEPSS 0.5%CVE-2025-20251HIGHCisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File DeletionEPSS 0.5%CVE-2025-20621MEDIUMWebapp crash via object that can't be cast to String in Attachment FieldEPSS 0.5%CVE-2025-61672MEDIUMSynapse: Invalid device keys degrade federation functionalityEPSS 0.5%CVE-2026-4773HIGHOTP Bypass in Magarsus' IDM-MFAEPSS 0.5%CVE-2026-94570MEDIUMCVE-2026-94570EPSS 0.5%CVE-2025-24804MEDIUMPartial Denial of Service (DoS) in MobSFEPSS 0.5%CVE-2026-107723HIGHfast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayEPSS 0.5%CVE-2021-47156MEDIUMThe Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (EPSS 0.5%CVE-2026-54235MEDIUMvLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernelsEPSS 0.4%CVE-2026-33806HIGHfastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type HeaderEPSS 0.4%