Fallos del tipo CWE-20

5451 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2024-39780HIGHUse of unsafe yaml load in dynparamEPSS 0.4%CVE-2025-23202CRITICALImproper Input Validation in Bible Module for ROBLOXEPSS 0.4%CVE-2025-47968HIGHMicrosoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2021-34714HIGHMultiple Cisco Operating Systems Unidirectional Link Detection Denial of Service VulnerabilityEPSS 0.4%CVE-2026-103237HIGHMISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant RowsEPSS 0.4%CVE-2026-61427MEDIUMPraisonAI before 4.6.78 Authentication Bypass via HTTP-streamEPSS 0.4%CVE-2021-0126HIGHImproper input validation for the Intel(R) Manageability Commander before version 2.2 may allow an authenticated user to potentially enable EPSS 0.4%CVE-2025-40831HIGHA vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of dEPSS 0.4%CVE-2022-36859MEDIUMImproper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victimEPSS 0.4%CVE-2026-31192MEDIUMInsufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitivEPSS 0.4%CVE-2026-60719CRITICALVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected areEPSS 0.4%CVE-2026-79139HIGHImproper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rEPSS 0.4%CVE-2020-3602MEDIUMCisco StarOS Privilege Escalation VulnerabilityEPSS 0.4%CVE-2019-1656MEDIUMCisco Enterprise NFV Infrastructure Software Linux Shell Access VulnerabilityEPSS 0.4%CVE-2023-21647MEDIUMImproper Input Validation in Bluetooth HOSTEPSS 0.4%CVE-2026-13925HIGHInappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user EPSS 0.4%CVE-2022-39017HIGHXSS in all comments fields in M-Files HubshareEPSS 0.4%CVE-2026-28322MEDIUMSolarWinds Database Performance Analyzer Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2019-15959MEDIUMCisco Small Business SPA500 Series IP Phones Local Script Execution VulnerabilityEPSS 0.4%CVE-2026-3620MEDIUMWord Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' ParameterEPSS 0.4%