Fallos del tipo CWE-20

5432 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2022-23998MEDIUMImproper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in AEPSS 0.6%CVE-2023-29134HIGHAn issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.EPSS 0.6%CVE-2022-32240—When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise ViewEPSS 0.6%CVE-2026-43793CRITICALAn issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS SEPSS 0.6%CVE-2022-32241—When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual EnterpriseEPSS 0.6%CVE-2022-32237—When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual EnterpriEPSS 0.6%CVE-2023-30542MEDIUMGovernorCompatibilityBravo may trim proposal calldataEPSS 0.6%CVE-2025-68667CRITICALConduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issueEPSS 0.6%CVE-2026-48922HIGHJenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aEPSS 0.6%CVE-2026-47641MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.6%CVE-2026-62917MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.6%CVE-2025-27211HIGHAn Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with acEPSS 0.6%CVE-2018-0249—A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCAEPSS 0.6%CVE-2018-0307—A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an EPSS 0.6%CVE-2026-70607MEDIUMElectron: window.open features string controls some window options considered privilegedEPSS 0.6%CVE-2026-25117HIGHpwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript executionEPSS 0.6%CVE-2023-21559MEDIUMWindows Cryptographic Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-21540MEDIUMWindows Cryptographic Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-21550MEDIUMWindows Cryptographic Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-35048CRITICALPiwigo RCE via PHP Code Injection into Config File in InstallerEPSS 0.6%