Falhas do tipo CWE-233

32 resultados

Manipulação inadequada de parâmetros

O código não valida, sanitiza ou processa corretamente os parâmetros recebidos de entrada (via argumentos de função, requisições HTTP, variáveis de ambiente, etc.), permitindo que dados malformados, maliciosos ou inesperados cheguem à lógica sensível. Isso pode levar a injeção, corrupção de estado, bypass de controles ou crashes.

Exemplo

Uma API aceita um parâmetro 'quantidade' sem verificar se é negativo, permitindo que um atacante envie quantidade=-100 e cause lógica de negócio errada; ou um programa lê argumentos de linha de comando sem escapar caracteres especiais, permitindo injeção de comando.

Como mitigar

Implemente validação explícita de todos os parâmetros de entrada (tipo, comprimento, intervalo, formato) antes de usar; use listas de permissão (whitelist) para valores esperados e rejeite o resto; escape ou sanitize dados quando forem passados para contextos sensíveis (SQL, shell, HTML).

CVE-2025-52970HIGHA improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 throuEPSS 10.1%CVE-2021-1230HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityEPSS 1.5%CVE-2023-20076HIGHCisco IOx Application Hosting Environment Command Injection VulnerabilityEPSS 1.5%CVE-2024-24525CRITICALAn issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametEPSS 1.1%CVE-2022-45182CRITICALPi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.EPSS 1.0%CVE-2024-31808HIGHTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in EPSS 0.9%CVE-2022-3697—A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. ThEPSS 0.9%CVE-2021-0269HIGHJunos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.EPSS 0.9%CVE-2022-32261MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguratEPSS 0.7%CVE-2024-9329MEDIUMGlassfish redirect to untrusted siteEPSS 0.7%CVE-2024-33433MEDIUMCross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via thEPSS 0.6%CVE-2022-22792MEDIUMMobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersEPSS 0.6%CVE-2024-25979MEDIUMMsa-24-0002: forum search accepted random parameters in its urlEPSS 0.6%CVE-2021-45477MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2021-45478MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2026-32998CRITICALThis vulnerability in Veeam Service Provider Console allows for remote code execution.EPSS 0.5%CVE-2026-2370HIGHImproper Handling of Parameters in GitLabEPSS 0.4%CVE-2023-26549—The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability maEPSS 0.4%CVE-2026-22626MEDIUMDue to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal deviEPSS 0.4%CVE-2026-55835MEDIUMLookyloo: Potential sub-system DoS due to parameter missmatch in notificationEPSS 0.4%