Falhas do tipo CWE-1287

160 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2026-2454MEDIUMDoS in Calls plugin via malformed msgpack in websocket request.EPSS 0.3%CVE-2025-59275HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-59278HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-42916HIGHMissing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)EPSS 0.3%CVE-2026-29788HIGHTSPortal: Anyone can forge self-deletion requests of any userEPSS 0.3%CVE-2023-29126MEDIUMInsecure loose comparison in Enel X JuiceBoxEPSS 0.3%CVE-2026-45069HIGHSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsEPSS 0.3%CVE-2023-2431LOWBypass of seccomp profile enforcementEPSS 0.3%CVE-2025-9524MEDIUMThe VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerabilitEPSS 0.3%CVE-2026-4646MEDIUMInsufficient input validation in GitHub plugin API causes denial of serviceEPSS 0.3%CVE-2025-20756MEDIUMIn Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogEPSS 0.2%CVE-2025-52883MEDIUMMeshtastic-Android vulnerable to forged DMs with no PKC showing up as encryptedEPSS 0.2%CVE-2026-10825HIGHImproper JSON Input Validation in WebSocket API Leads to Denial of ServiceEPSS 0.2%CVE-2025-42929HIGHMissing input validation vulnerability in SAP Landscape Transformation Replication ServerEPSS 0.2%CVE-2026-5304MEDIUMAn ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be explEPSS 0.2%CVE-2024-3175HIGHInsufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalationEPSS 0.2%CVE-2026-52763MEDIUMYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2024-1578MEDIUMMultiple MiCard PLUS card reader dropped charactersEPSS 0.2%CVE-2025-53627MEDIUMMeshtastic firmware allows forged DMs with no PKC to show up as encryptedEPSS 0.2%