Fallos del tipo CWE-241

33 resultados

Tratamento inadequado de tipos de dados inesperados

Ocorre quando o código assume que uma variável, parâmetro ou entrada terá um tipo específico, mas não valida ou trata casos onde o tipo real é diferente. Se o código não verifica o tipo antes de usar, pode causar crashes, comportamentos impredizíveis ou execução de lógica errada.

Ejemplo

Uma API recebe um campo 'idade' esperando sempre um inteiro. Se um atacante envia uma string ou null, e o código tenta fazer cálculos sem validar primeiro, ocorre erro de tipo ou desvio lógico que pode ser explorado para bypass de validação ou negação de serviço.

Cómo mitigar

Sempre valide o tipo de dados na entrada (use type hints, assertions ou verificações explícitas). Em linguagens dinâmicas, implemente guards claros antes de operar sobre dados externos; em linguagens tipadas, enforce tipos em tempo de compilação e use safe parsing com tratamento de erro.

CVE-2023-30591HIGHNodeBB Pre-Authentication Denial-of-ServiceEPSS 53.8%CVE-2022-29181HIGHImproper Handling of Unexpected Data Type in NokogiriEPSS 3.3%CVE-2021-39131HIGHImproper Handling of Unexpected Data Type in cedEPSS 1.9%CVE-2021-40116HIGHMultiple Cisco Products Snort Rule Denial of Service VulnerabilityEPSS 1.3%CVE-2022-24668—A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This aEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2021-32655LOWFiles Drop public link can be added as federated shareEPSS 1.0%CVE-2022-20730MEDIUMCisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass VulnerabilityEPSS 0.9%CVE-2024-25966MEDIUMDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthentEPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.7%CVE-2023-5215MEDIUMLibnbd: crash or misbehaviour when nbd server returns an unexpected block sizeEPSS 0.7%CVE-2022-1642—A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JEPSS 0.6%CVE-2024-21523HIGHAll versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuEPSS 0.6%CVE-2022-22219MEDIUMJunos OS and Junos OS Evolved: RPD core upon receipt of a specific EVPN route by a BGP route reflector in an EVPN environmentEPSS 0.6%CVE-2024-9423MEDIUMCertain HP LaserJet Printers – Potential Denial of ServiceEPSS 0.6%CVE-2024-21526HIGHAll versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyEPSS 0.6%CVE-2024-0151MEDIUMInsufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiledEPSS 0.4%CVE-2025-2268MEDIUMHP LaserJet MFP M232-M237 Printer Series - Potential Denial of ServiceEPSS 0.4%CVE-2023-28961MEDIUMJunos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is usedEPSS 0.4%CVE-2021-0242MEDIUMJunos OS: EX4300: FPC crash upon receipt of specific frames on an interface without L2PT or dot1x configuredEPSS 0.4%