Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2014-5410—Rockwell Automation Micrologix 1400 Improper Input ValidationEPSS 4.2%CVE-2020-8125—Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code EPSS 4.1%CVE-2017-12652CRITICALlibpng before 1.6.32 does not properly check the length of chunks against the user limit.EPSS 4.1%CVE-2023-5528HIGHKubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalationEPSS 4.1%CVE-2025-8876CRITICALCommand Injection VulnerabilityEPSS 4.1%KEVCVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%CVE-2023-34111HIGHCommand Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanapluginEPSS 4.0%CVE-2018-0378HIGHCisco NX-OS Software for Nexus 5500, 5600, and 6000 Series Switches Precision Time Protocol Denial of Service VulnerabilityEPSS 4.0%CVE-2021-1139CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.0%CVE-2021-1141CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.0%CVE-2024-30040HIGHWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 3.9%KEVCVE-2022-21668HIGHPipenv's requirements.txt parsing allows malicious index url in commentsEPSS 3.9%CVE-2026-47668CRITICALDbGate: Unauthenticated Remote Code Execution via JSON Script RunnerEPSS 3.9%CVE-2021-21085HIGHAdobe Connect CSV injection via export feature could lead to code executionEPSS 3.9%CVE-2020-11008MEDIUMMalicious URLs can still cause Git to send a stored credential to the wrong serverEPSS 3.9%CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.9%CVE-2022-35252LOWWhen curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back tEPSS 3.8%CVE-2018-8850—Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to crEPSS 3.8%CVE-2018-0467—Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service VulnerabilityEPSS 3.8%CVE-2018-0313—A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to thEPSS 3.8%