Falhas do tipo CWE-241

33 resultados

Tratamento inadequado de tipos de dados inesperados

Ocorre quando o código assume um tipo de dado específico (string, inteiro, objeto) sem validar ou converter apropriadamente, causando comportamento inesperado quando recebe um tipo diferente. Pode levar a crashes, lógica quebrada, ou execução de código indevido.

Exemplo

Uma API espera um ID numérico, mas recebe uma string com caracteres especiais ou um objeto JSON. Se o código não valida o tipo, pode tentar operações matemáticas em uma string, causando erro de execução ou interpretação errada dos dados.

Como mitigar

Sempre valide e normalize tipos de entrada — use type checks, conversão explícita com tratamento de erro, e schemas de validação (como JSON Schema ou Zod). Rejeite dados que não correspondam ao tipo esperado em vez de tentar convertê-los silenciosamente.

CVE-2023-30591HIGHNodeBB Pre-Authentication Denial-of-ServiceEPSS 53.8%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.3%CVE-2021-39131HIGHImproper Handling of Unexpected Data Type in cedEPSS 1.9%CVE-2021-40116HIGHMultiple Cisco Products Snort Rule Denial of Service VulnerabilityEPSS 1.3%CVE-2022-24668—A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This aEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2021-32655LOWFiles Drop public link can be added as federated shareEPSS 1.0%CVE-2022-20730MEDIUMCisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass VulnerabilityEPSS 0.9%CVE-2024-25966MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthentEPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.7%CVE-2023-5215MEDIUMLibnbd: crash or misbehaviour when nbd server returns an unexpected block sizeEPSS 0.7%CVE-2022-1642—A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JEPSS 0.6%CVE-2024-21523HIGHAll versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuEPSS 0.6%CVE-2022-22219MEDIUMJunos OS and Junos OS Evolved: RPD core upon receipt of a specific EVPN route by a BGP route reflector in an EVPN environmentEPSS 0.6%CVE-2024-9423MEDIUMCertain HP LaserJet Printers – Potential Denial of ServiceEPSS 0.6%CVE-2024-21526HIGHAll versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyEPSS 0.6%CVE-2024-0151MEDIUMInsufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiledEPSS 0.4%CVE-2025-2268MEDIUMHP LaserJet MFP M232-M237 Printer Series - Potential Denial of ServiceEPSS 0.4%CVE-2023-28961MEDIUMJunos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is usedEPSS 0.4%CVE-2021-0242MEDIUMJunos OS: EX4300: FPC crash upon receipt of specific frames on an interface without L2PT or dot1x configuredEPSS 0.4%