Fallos del tipo CWE-20

5453 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2025-11345MEDIUMILIAS Test Import unserialize deserializationEPSS 0.4%CVE-2022-38435HIGHAdobe Illustrator PCX File Parsing Memory Corruption Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-73334HIGHApache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationEPSS 0.4%CVE-2024-22271HIGHSpring Cloud Function Web DOS VulnerabilityEPSS 0.4%CVE-2025-40593HIGHA vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to control the device by storiEPSS 0.4%CVE-2026-20256MEDIUMImproper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk EnterpriseEPSS 0.4%CVE-2026-11046HIGHInsufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised thEPSS 0.4%CVE-2025-27599MEDIUMElement X Android vulnerable to loading malicious web pages via received intentEPSS 0.4%CVE-2024-11985MEDIUMAn improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router ImprEPSS 0.4%CVE-2026-21682HIGHiccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText()EPSS 0.4%CVE-2024-2513MEDIUMWP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image AttributeEPSS 0.4%CVE-2026-21692HIGHiccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-21688HIGHiccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cppEPSS 0.4%CVE-2026-21485HIGHiccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()EPSS 0.4%CVE-2026-21677HIGHiccDEV has Undefined Behavior in CIccCLUT::Init()EPSS 0.4%CVE-2023-42798HIGHAutomataCI Release Job Can Revert Repo to First CommitEPSS 0.4%CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2024-2226MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-47210MEDIUMImproper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user tEPSS 0.4%CVE-2025-52544HIGHArbitrary read file from the filesystemEPSS 0.4%