Fallos del tipo CWE-20

5391 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2021-1140CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2021-1138CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2018-15454HIGHCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 4.4%CVE-2019-1861HIGHCisco Industrial Network Director Remote Code Execution VulnerabilityEPSS 4.4%CVE-2021-1142CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.3%CVE-2016-8625MEDIUMcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and EPSS 4.3%CVE-2023-26405HIGHZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions BypassEPSS 4.3%CVE-2023-26407HIGHZDI-CAN-20712: Net.HTTP.request Arbitrary Command ExecutionEPSS 4.3%CVE-2018-10858MEDIUMA heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server couEPSS 4.3%CVE-2023-5528HIGHKubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalationEPSS 4.3%CVE-2017-6616—A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tEPSS 4.2%CVE-2020-3357CRITICALCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service VulnerabilityEPSS 4.2%CVE-2017-14022—An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unautheEPSS 4.2%CVE-2021-3907HIGHArbitrary filepath traversal via URI injectionEPSS 4.2%CVE-2018-13807—A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versEPSS 4.2%CVE-2014-5410—Rockwell Automation Micrologix 1400 Improper Input ValidationEPSS 4.2%CVE-2020-8125—Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code EPSS 4.1%CVE-2020-3263HIGHCisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution VulnerabilityEPSS 4.1%CVE-2017-12652CRITICALlibpng before 1.6.32 does not properly check the length of chunks against the user limit.EPSS 4.1%CVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%