Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2023-41061HIGHA validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafEPSS 4.4%KEVCVE-2021-1142CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2025-34101CRITICALServiio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO ParameterEPSS 4.4%CVE-2016-9579MEDIUMA flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucEPSS 4.3%CVE-2018-0279—A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticateEPSS 4.3%CVE-2016-8625MEDIUMcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and EPSS 4.3%CVE-2023-26405HIGHZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions BypassEPSS 4.3%CVE-2023-26407HIGHZDI-CAN-20712: Net.HTTP.request Arbitrary Command ExecutionEPSS 4.3%CVE-2017-2669LOWDovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the useEPSS 4.3%CVE-2018-10858MEDIUMA heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server couEPSS 4.3%CVE-2022-35668MEDIUMAdobe Acrobat Reader Improper Input Validation Memory leakEPSS 4.3%CVE-2019-1861HIGHCisco Industrial Network Director Remote Code Execution VulnerabilityEPSS 4.3%CVE-2022-40773HIGHZoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows EPSS 4.3%CVE-2018-15454HIGHCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 4.3%CVE-2017-6616—A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tEPSS 4.2%CVE-2020-3357CRITICALCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service VulnerabilityEPSS 4.2%CVE-2020-3263HIGHCisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution VulnerabilityEPSS 4.2%CVE-2017-14022—An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unautheEPSS 4.2%CVE-2021-3907HIGHArbitrary filepath traversal via URI injectionEPSS 4.2%CVE-2018-13807—A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versEPSS 4.2%