Falhas do tipo CWE-670

110 resultados

Validação inadequada de entrada

A aplicação aceita dados do usuário sem verificar corretamente se estão no formato, tamanho ou conteúdo esperado antes de usá-los. Isso permite que entradas malformadas ou maliciosas causem comportamentos inesperados, desde injeção de código até travamentos.

Exemplo

Um formulário web que recebe um CPF não valida o formato (deve ter 11 dígitos) e passa direto para a query SQL. Um atacante injeta comando SQL disfarçado de CPF, ou um campo de data aceita strings arbitrárias e quebra a lógica de cálculo da aplicação.

Como mitigar

Implemente whitelist de caracteres permitidos, valide tipo e tamanho na entrada, use prepared statements para SQL, e trate erros sem expor detalhes internos. Nunca confie em dados do cliente, mesmo que venham de JavaScript — valide sempre no servidor.

CVE-2022-29609MEDIUMAn issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rEPSS 0.6%CVE-2022-31017LOWExpression Always True vulnerability in Zulip ServerEPSS 0.6%CVE-2024-45311HIGHDenial of service in quinn-proto when using `Endpoint::retry()`EPSS 0.6%CVE-2024-35190MEDIUMAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsEPSS 0.6%CVE-2026-55276CRITICALApache Tomcat: Logged effective web.xml is incompleteEPSS 0.6%CVE-2022-2993HIGHbt: host: Wrong key validation checkEPSS 0.6%CVE-2023-32675LOWNonpayable default functions are sometimes payable in vyperEPSS 0.6%CVE-2023-49798MEDIUMDuplicated execution of subcalls in OpenZeppelin ContractsEPSS 0.5%CVE-2023-41052LOWVyper: incorrect order of evaluation of side effects for some builtinsEPSS 0.5%CVE-2024-45807HIGHoghttp2 crash on OnBeginHeadersForStream in envoyEPSS 0.5%CVE-2023-40015LOWVyper: reversed order of side effects for some operationsEPSS 0.5%CVE-2024-45304MEDIUMOwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contractsEPSS 0.5%CVE-2025-29312CRITICALAn issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link tEPSS 0.5%CVE-2021-43819HIGHStargate-Bukkit improperly handles vehicles causing data duplication.EPSS 0.5%CVE-2026-20171MEDIUMCisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service VulnerabilityEPSS 0.5%CVE-2024-25622LOWH2O ignores headers configuration directivesEPSS 0.5%CVE-2025-32996MEDIUMIn http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.EPSS 0.5%CVE-2026-1874HIGHDenial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet moduleEPSS 0.4%CVE-2026-19487MEDIUMPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclassEPSS 0.4%CVE-2022-25745CRITICALAlways Incorrect Control Flow Implementation in MODEMEPSS 0.4%