Falhas do tipo CWE-1287

160 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2026-25179HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-49941HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate IP addressesEPSS 0.3%CVE-2025-3070MEDIUMInsufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilEPSS 0.3%CVE-2025-9041HIGHRockwell Automation FLEX 5000 I/O - Module FaultEPSS 0.3%CVE-2025-9042HIGHRockwell Automation FLEX 5000 I/O - Module FaultEPSS 0.3%CVE-2025-8402MEDIUMNil pointer dereference in bulk import crashes serverEPSS 0.3%CVE-2026-11460MEDIUMBoost Serialization improper validation of specified type of inputEPSS 0.3%CVE-2025-40910MEDIUMNet::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.3%CVE-2026-2092HIGHKeycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsEPSS 0.3%CVE-2024-8058HIGHAn improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary EPSS 0.3%CVE-2026-9753HIGHServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.EPSS 0.3%CVE-2024-42189MEDIUMHCL BigFix Web Reports might be subject to a Denial of Service (DoS) attackEPSS 0.3%CVE-2025-58084LOWMattermost Desktop App crashes when clicking on malformed external URLEPSS 0.3%CVE-2026-2003MEDIUMPostgreSQL oidvector discloses a few bytes of memoryEPSS 0.3%CVE-2026-9390CRITICALXML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupEPSS 0.3%CVE-2026-25783MEDIUMDenial of service via malformed User-Agent header in getBrowserVersionEPSS 0.3%CVE-2025-12689MEDIUMDoS in Calls plugin via malformed UTF-8 in WebSocket requestEPSS 0.3%CVE-2024-12756HIGHAvaya Spaces HTML injection (HTMLi) VulnerabilityEPSS 0.3%CVE-2024-8125MEDIUMA remote code vulnerability has been discovered in OpenText™ Content Management.EPSS 0.3%CVE-2026-87012MEDIUMOpen WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueEPSS 0.3%