Falhas do tipo CWE-1284

272 resultados

Validação inadequada de quantidade em entrada

Ocorre quando o software aceita entrada do usuário que especifica uma quantidade (número de items, tamanho de buffer, contagem de loops, etc.) sem validar se esse valor está dentro dos limites esperados. Um atacante pode fornecer uma quantidade excessiva, nula ou negativa, causando alocação de memória descontrolada, loops infinitos, underflow ou acesso a dados não inicializados.

Exemplo

Um serviço web recebe um parâmetro 'quantidade_registros' para retornar dados. Se não validar o valor, um atacante envia quantidade_registros=999999999, forçando alocação massiva de memória e negação de serviço; ou envia -1 e o código interpreta como unsigned, provocando comportamento inesperado.

Como mitigar

Valide explicitamente toda entrada que represente uma quantidade: defina limites mínimo e máximo aceitáveis, rejeite valores fora do intervalo, e use tipos numéricos apropriados (prefira unsigned para contagens, com overflow checks). Teste casos extremos (zero, negativo, muito grande).

CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.3%CVE-2025-9316MEDIUMN-central unauthenticated sessionID generationEPSS 36.3%CVE-2009-4488CRITICALVarnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window'sEPSS 12.8%CVE-2025-4365MEDIUMNetScaler Console and NetScaler SDX (SVM) - Arbitrary file readEPSS 8.3%CVE-2025-5349HIGHNetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management InterfaceEPSS 4.3%CVE-2008-2374CRITICALsrc/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string lengtEPSS 4.3%CVE-2023-38709HIGHApache HTTP Server: HTTP response splittingEPSS 3.9%CVE-2013-0270MEDIUMKeystone: openstack keystone: denial of service via large http request with long tenant nameEPSS 3.1%CVE-2025-8424HIGHImproper access control on the NetScaler Management InterfaceEPSS 2.8%CVE-2024-6768MEDIUMDenial of Service in CLFS.sysEPSS 2.5%CVE-2026-23864HIGHMultiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reacEPSS 2.4%CVE-2021-31346HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.9%CVE-2022-28199MEDIUMNVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is nEPSS 1.9%CVE-2026-49777CRITICALWordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerabilityEPSS 1.7%CVE-2021-31345HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.6%CVE-2020-27217—In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particEPSS 1.3%CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 1.1%CVE-2022-2592MEDIUMA lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prEPSS 1.1%CVE-2023-34188—The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload overEPSS 1.0%CVE-2023-30082HIGHA denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is suppliedEPSS 1.0%