Falhas do tipo CWE-1287

160 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2024-2105MEDIUMJBL: Improper validation of ICM field in connection requestsEPSS 0.2%CVE-2019-25596MEDIUMSpotAuditor 5.2.6 Name Field Denial of ServiceEPSS 0.2%CVE-2025-32901MEDIUMIn KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.EPSS 0.2%CVE-2025-13352LOWMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingEPSS 0.2%CVE-2026-7887LOWFor Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusEPSS 0.2%CVE-2026-75588LOWMattermost Desktop App plugin popout scheme validation bypassEPSS 0.2%CVE-2025-20155MEDIUMA vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to aEPSS 0.2%CVE-2026-20074HIGHCisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service VulnerabilityEPSS 0.2%CVE-2025-30027MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only bEPSS 0.2%CVE-2025-4645MEDIUMAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only bEPSS 0.1%CVE-2024-6858MEDIUMIn Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.EPSS 0.1%CVE-2025-6298MEDIUMACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerabiEPSS 0.1%CVE-2026-82741LOWAsh.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionEPSS 0.1%CVE-2026-40851HIGHCommand injection via USBEPSS 0.1%CVE-2026-80051MEDIUMgithub.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The bEPSS 0.1%CVE-2025-8108MEDIUMAn ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vEPSS 0.1%CVE-2024-40682MEDIUMIBM SmartCloud Analytics - Log Analysis denial of serviceEPSS 0.1%CVE-2026-20498MEDIUMIn geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.1%CVE-2026-17113MEDIUMCri-o: cri-o: unvalidated image env var causes daemon crashEPSS 0.1%CVE-2026-94570MEDIUMCVE-2026-94570EPSS —