Falhas do tipo CWE-670

119 resultados

Validação inadequada de entrada

A aplicação aceita dados do usuário sem verificar corretamente se estão no formato, tamanho ou conteúdo esperado antes de usá-los. Isso permite que entradas malformadas ou maliciosas causem comportamentos inesperados, desde injeção de código até travamentos.

Exemplo

Um formulário web que recebe um CPF não valida o formato (deve ter 11 dígitos) e passa direto para a query SQL. Um atacante injeta comando SQL disfarçado de CPF, ou um campo de data aceita strings arbitrárias e quebra a lógica de cálculo da aplicação.

Como mitigar

Implemente whitelist de caracteres permitidos, valide tipo e tamanho na entrada, use prepared statements para SQL, e trate erros sem expor detalhes internos. Nunca confie em dados do cliente, mesmo que venham de JavaScript — valide sempre no servidor.

CVE-2026-117859MEDIUMKeycloak-services: keycloak-services: par single-use bypass via flow restartEPSS 0.2%CVE-2024-35312MEDIUMIn Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.EPSS 0.2%CVE-2026-41988LOWuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUIDEPSS 0.2%CVE-2024-0313MEDIUMA malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrarEPSS 0.2%CVE-2026-72704MEDIUMRocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After TransportEPSS 0.2%CVE-2026-72703MEDIUMRocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-CallsEPSS 0.2%CVE-2026-72705MEDIUMRocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order ArgumentEPSS 0.2%CVE-2026-40960HIGHLuanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods oEPSS 0.2%CVE-2026-40200HIGHAn issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due toEPSS 0.2%CVE-2026-12321MEDIUMJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.2%CVE-2025-33199LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successfuEPSS 0.1%CVE-2026-73283LOWIn sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.EPSS 0.1%CVE-2023-20915HIGHIn addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due toEPSS 0.1%CVE-2026-107284LOWAsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept checkEPSS 0.1%CVE-2026-35343LOWuutils coreutils cut Inconsistent Output Suppression with Newline DelimitersEPSS 0.1%CVE-2026-106586LOWIn sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a EPSS 0.1%CVE-2026-41527MEDIUMKDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the meEPSS 0.1%CVE-2022-26461MEDIUMIn vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2026-20713MEDIUMAlways-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. SysEPSS 0.1%