Fallos del tipo CWE-20

5395 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2018-8867—In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystemsEPSS 3.4%CVE-2024-20733MEDIUM[ZS-VR-23-360] Adobe Acrobat Reader Parsing OTF font Denial-of-Service VulnerabilityEPSS 3.4%CVE-2019-1754HIGHCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 3.4%CVE-2019-1755MEDIUMCisco IOS XE Software Command Injection VulnerabilityEPSS 3.4%CVE-2025-55692HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 3.4%CVE-2018-0239—A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASEPSS 3.4%CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2020-3341HIGHClamAV PDF Parsing Denial of Service VulnerabilityEPSS 3.4%CVE-2018-11615—This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required toEPSS 3.3%CVE-2018-10929HIGHA flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitraryEPSS 3.3%CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.3%CVE-2025-34115HIGHOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpEPSS 3.3%CVE-2009-2055MEDIUMCisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalEPSS 3.3%KEVCVE-2020-25643—A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by iEPSS 3.3%CVE-2019-15958HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilityEPSS 3.3%CVE-2019-9503HIGHBroadcom brcmfmac driver is vulnerable to a frame validation bypassEPSS 3.3%CVE-2023-40743CRITICALApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceEPSS 3.3%CVE-2018-0280—A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, rEPSS 3.3%CVE-2018-0325—A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP PhoneEPSS 3.3%CVE-2019-15957HIGHCisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection VulnerabilityEPSS 3.2%