Fallos del tipo CWE-1286

90 resultados

Validação inadequada da sintaxe de entrada

O software aceita entrada do usuário sem verificar corretamente se ela segue o formato esperado, permitindo dados malformados ou inesperados processarem normalmente. Isso pode levar a interpretações incorretas, injeções ou comportamentos impredizíveis quando o parser ou processador tenta lidar com dados que deveriam ser rejeitados.

Ejemplo

Um serviço web aceita um JSON sem validar se é válido (aspas desalinhadas, chaves incompletas), e ao processar com lenient parsing, um atacante injeta comandos ou campos extras que alteram a lógica da aplicação. Ou uma API que não valida um CSV antes de importar, permitindo que linhas malformadas causem execução de código ou corrupção de dados.

Cómo mitigar

Implemente validação sintática rigorosa antes de processar qualquer entrada: parse com strict mode, rejeite dados malformados explicitamente, e use schemas (JSON Schema, DTD, etc.). Nunca confie em lenient parsing ou tratamento silencioso de erros de sintaxe — falhe aberto (fail-safe).

CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2024-51983HIGHUnauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.EPSS 8.6%CVE-2025-13878HIGHMalformed BRID/HHIT records can cause named to terminate unexpectedlyEPSS 8.2%CVE-2024-51982HIGHUnauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.EPSS 7.8%CVE-2026-21527MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 7.7%CVE-2023-27043MEDIUMThe email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2EPSS 2.5%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2022-1941HIGHOut of Memory issue in ProtocolBuffers for cpp and pythonEPSS 1.2%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 1.0%CVE-2024-6763LOWJetty URI parsing of invalid authorityEPSS 1.0%CVE-2021-31988—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and EPSS 1.0%CVE-2021-31987—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipEPSS 0.9%CVE-2024-3384HIGHPAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsEPSS 0.9%CVE-2025-22868HIGHUnexpected memory consumption during token parsing in golang.org/x/oauth2EPSS 0.8%CVE-2025-25007MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.8%CVE-2024-29041MEDIUMExpress.js Open Redirect in malformed URLsEPSS 0.8%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 0.7%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.7%CVE-2021-44695MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.7%CVE-2022-22192HIGHJunos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the deviceEPSS 0.7%