Fallos del tipo CWE-20

5429 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-81180HIGHSysReptor: Authenticated RCE by insecure image processingEPSS 0.7%CVE-2026-58183HIGHApache Traffic Server: prefetch plugin can crash on attacker-influenced inputEPSS 0.7%CVE-2024-27201MEDIUMAn improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS PlatforEPSS 0.7%CVE-2026-24713CRITICALApache IoTDB: JEXL Expression Injection VulnerabilityEPSS 0.7%CVE-2023-29410HIGH A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the appliEPSS 0.7%CVE-2025-61809CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 0.7%CVE-2023-21494MEDIUMPotential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remoteEPSS 0.7%CVE-2025-66259CRITICALAuthenticated Root Remote Code Execution through improper filtering of HTTP post request parametersEPSS 0.7%CVE-2026-46457HIGHApache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headersEPSS 0.7%CVE-2025-65946HIGHRoo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation BugEPSS 0.7%CVE-2023-22730MEDIUMImproper Input Validation of Clearance sale in cartEPSS 0.7%CVE-2020-3319LOWCisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityEPSS 0.7%CVE-2026-23570MEDIUMLog timestamp tampering vulnerability in Content Distribution ServiceEPSS 0.7%CVE-2024-28103MEDIUMAction Pack is missing security headers on non-HTML responsesEPSS 0.7%CVE-2020-3322LOWCisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityEPSS 0.7%CVE-2022-46401MEDIUMThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pEPSS 0.7%CVE-2024-23668HIGHAn improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2EPSS 0.7%CVE-2026-42588HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorEPSS 0.7%CVE-2023-20192CRITICALCisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation VulnerabilitiesEPSS 0.7%CVE-2022-40237MEDIUMIBM MQ for HPE NonStop denial of serviceEPSS 0.7%