Falhas do tipo CWE-670

110 resultados

Validação inadequada de entrada

A aplicação aceita dados do usuário sem verificar corretamente se estão no formato, tamanho ou conteúdo esperado antes de usá-los. Isso permite que entradas malformadas ou maliciosas causem comportamentos inesperados, desde injeção de código até travamentos.

Exemplo

Um formulário web que recebe um CPF não valida o formato (deve ter 11 dígitos) e passa direto para a query SQL. Um atacante injeta comando SQL disfarçado de CPF, ou um campo de data aceita strings arbitrárias e quebra a lógica de cálculo da aplicação.

Como mitigar

Implemente whitelist de caracteres permitidos, valide tipo e tamanho na entrada, use prepared statements para SQL, e trate erros sem expor detalhes internos. Nunca confie em dados do cliente, mesmo que venham de JavaScript — valide sempre no servidor.

CVE-2026-40942MEDIUMDSF: Inverted Time Comparison in OIDC JWKS and Token CacheEPSS 0.3%CVE-2023-20921HIGHIn onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logicEPSS 0.3%CVE-2024-30133MEDIUMHCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerabilityEPSS 0.3%CVE-2026-73468HIGHSecurity Advisory 0175EPSS 0.3%CVE-2024-47763MEDIUMWasmtime runtime crash when combining tail calls with trapping importsEPSS 0.2%CVE-2025-32942HIGHSSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.EPSS 0.2%CVE-2026-35387LOWOpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgoEPSS 0.2%CVE-2026-40394MEDIUMVarnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certEPSS 0.2%CVE-2026-55624MEDIUMMintyItanium Lost-Auction takes items like barrier blocks out from search GUIEPSS 0.2%CVE-2026-14935LOWGstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence checkEPSS 0.2%CVE-2026-92932MEDIUMMISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is DisabledEPSS 0.2%CVE-2026-44928LOWIn uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.EPSS 0.2%CVE-2024-53134MEDIUMpmdomain: imx93-blk-ctrl: correct remove pathEPSS 0.2%CVE-2024-35312MEDIUMIn Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.EPSS 0.2%CVE-2026-41988LOWuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUIDEPSS 0.2%CVE-2024-0313MEDIUMA malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrarEPSS 0.2%CVE-2026-35414MEDIUMOpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with aEPSS 0.2%CVE-2026-40960HIGHLuanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods oEPSS 0.2%CVE-2026-40200HIGHAn issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due toEPSS 0.2%CVE-2026-12321MEDIUMJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.2%