Falhas do tipo CWE-233

31 resultados

Manipulação inadequada de parâmetros

O código não valida, sanitiza ou processa corretamente os parâmetros recebidos de entrada (via argumentos de função, requisições HTTP, variáveis de ambiente, etc.), permitindo que dados malformados, maliciosos ou inesperados cheguem à lógica sensível. Isso pode levar a injeção, corrupção de estado, bypass de controles ou crashes.

Exemplo

Uma API aceita um parâmetro 'quantidade' sem verificar se é negativo, permitindo que um atacante envie quantidade=-100 e cause lógica de negócio errada; ou um programa lê argumentos de linha de comando sem escapar caracteres especiais, permitindo injeção de comando.

Como mitigar

Implemente validação explícita de todos os parâmetros de entrada (tipo, comprimento, intervalo, formato) antes de usar; use listas de permissão (whitelist) para valores esperados e rejeite o resto; escape ou sanitize dados quando forem passados para contextos sensíveis (SQL, shell, HTML).

CVE-2025-52970HIGHA improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.EPSS 9.8%CVE-2023-20076HIGHCisco IOx Application Hosting Environment Command Injection VulnerabilityEPSS 1.5%CVE-2021-1230HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service VulnerabilityEPSS 1.5%CVE-2024-24525CRITICALAn issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parametEPSS 1.1%CVE-2024-31808HIGHTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in EPSS 0.9%CVE-2022-45182CRITICALPi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.EPSS 0.9%CVE-2021-0269HIGHJunos OS: J-Web can be compromised through reflected client-side HTTP parameter pollution attacks.EPSS 0.9%CVE-2022-3697—A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. ThEPSS 0.7%CVE-2024-9329MEDIUMGlassfish redirect to untrusted siteEPSS 0.7%CVE-2022-32261MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguratEPSS 0.7%CVE-2024-33433MEDIUMCross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via thEPSS 0.6%CVE-2022-22792MEDIUMMobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersEPSS 0.6%CVE-2021-45477MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2021-45478MEDIUMIDOR in Yordam Library Automation SystemEPSS 0.6%CVE-2024-25979MEDIUMMsa-24-0002: forum search accepted random parameters in its urlEPSS 0.6%CVE-2026-2370HIGHImproper Handling of Parameters in GitLabEPSS 0.4%CVE-2023-26549—The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability maEPSS 0.4%CVE-2026-32998CRITICALThis vulnerability in Veeam Service Provider Console allows for remote code execution.EPSS 0.4%CVE-2020-10069MEDIUMZephyr Bluetooth unchecked packet data results in denial of serviceEPSS 0.4%CVE-2023-1419MEDIUMDebezium: script injection via connector parameterEPSS 0.4%