Fallos del tipo CWE-682

65 resultados

Cálculo incorreto

A aplicação realiza um cálculo matemático ou lógico que produz um resultado errado ou inesperado, comprometendo a integridade dos dados ou a segurança da operação. Isso pode ocorrer por erro de lógica, falta de validação de entrada, overflow/underflow, ou operações com tipos de dados incompatíveis.

Ejemplo

Um sistema de e-commerce calcula o preço final usando '(quantidade * preço_unitário) / 100' para aplicar desconto, mas quando quantidade ou preço são muito grandes, ocorre overflow antes da divisão, resultando em um valor final drasticamente menor que o esperado. Um atacante compra itens caros por centavos.

Cómo mitigar

Valide todas as entradas numéricas (faixa, tipo, tamanho), use bibliotecas ou linguagens com validação automática de overflow, implemente testes de casos extremos (valores mínimos, máximos, negativos), e revise a lógica aritmética com atenção especial a ordem de operações e tipos de dados.

CVE-2026-1229LOWIncorrect calculation in CIRCL secp384r1 CombinedMultEPSS 0.4%CVE-2025-55552MEDIUMpytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.EPSS 0.4%CVE-2024-32873LOWevmos allows transferring unvested tokens after delegationsEPSS 0.4%CVE-2025-59047LOWmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodEPSS 0.4%CVE-2026-24783HIGHsoroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with NegativesEPSS 0.4%CVE-2023-36980—An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds thEPSS 0.4%CVE-2026-44074LOWBitwise OR of errno valuesEPSS 0.3%CVE-2025-26622LOWsqrt doesn't define rounding behavior in VyperEPSS 0.3%CVE-2026-33487HIGHgoxmldsig has validateSignature Loop Variable Capture Signature BypassEPSS 0.3%CVE-2024-25883MEDIUMThe mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.EPSS 0.3%CVE-2026-44498CRITICALZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsEPSS 0.3%CVE-2026-10512LOWX25519 x86_64 assembly final reduction leaves non-canonical field elementEPSS 0.3%CVE-2026-7836LOWhextoint macro uppercase bugEPSS 0.3%CVE-2026-20270HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.3%CVE-2023-43490MEDIUMIncorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to EPSS 0.2%CVE-2026-28410MEDIUMThe Graph: Revocable vesting contracts allows early access to locked tokensEPSS 0.2%CVE-2021-34573MEDIUMIncorrect calculation in Enbra EWM does not report backflows or no flow eventsEPSS 0.2%CVE-2026-21911HIGHJunos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stopEPSS 0.2%CVE-2026-25634HIGHiccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()EPSS 0.2%CVE-2024-6287HIGHIncorrect Address Range CalculationsEPSS 0.2%