Falhas do tipo CWE-1287

149 resultados

Validação insuficiente de tipo de entrada

A aplicação aceita entrada do usuário sem verificar se ela corresponde ao tipo de dado esperado (inteiro, string, booleano, etc.). Isso permite que um atacante envie dados de tipo inesperado, causando comportamento anômalo, bypass de lógica ou até execução de código malicioso.

Exemplo

Um formulário espera um ID numérico, mas não valida o tipo antes de usar: quando um atacante envia uma string com comando SQL ou script JavaScript em vez de um número, o código processa normalmente e a injeção acontece.

Como mitigar

Valide explicitamente o tipo de cada entrada (use type hints, schemas de validação como JSON Schema, ou funções de cast com tratamento de erro). Nunca confie no tipo declarado pelo cliente; revalide no servidor. Use casting seguro com falha clara se o tipo não corresponder.

CVE-2024-5594CRITICALOpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arEPSS 0.8%CVE-2024-31948MEDIUMIn FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crashEPSS 0.8%CVE-2026-24307CRITICALM365 Copilot Information Disclosure VulnerabilityEPSS 0.8%CVE-2026-2004HIGHPostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary codeEPSS 0.8%CVE-2023-3917MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2024-9404MEDIUMDenial-of-Service VulnerabilityEPSS 0.8%CVE-2023-3904MEDIUMImproper Validation of Specified Type of Input in GitLabEPSS 0.8%CVE-2025-12977CRITICALCVE-2025-12977EPSS 0.7%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2025-46342HIGHKyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsEPSS 0.7%CVE-2024-8403HIGHDenial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP ModuleEPSS 0.7%CVE-2026-50524HIGH.NET Framework Denial of Service VulnerabilityEPSS 0.6%CVE-2022-22228HIGHJunos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packetEPSS 0.6%CVE-2023-2673MEDIUMPHOENIX CONTACT: FL/TC MGUARD prone to Improper Input ValidationEPSS 0.6%CVE-2024-47504HIGHJunos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crashEPSS 0.6%CVE-2021-44694MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.6%CVE-2025-20033MEDIUMDoS via custom post type for sysconsole plugin readersEPSS 0.6%CVE-2024-56908MEDIUMIn Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providiEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2024-54083MEDIUMDoS via lack of type validation in CallsEPSS 0.6%