Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2021-22484HIGHSome Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnEPSS 0.3%CVE-2022-30713HIGHImproper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.EPSS 0.3%CVE-2022-30711HIGHImproper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.EPSS 0.3%CVE-2022-30710HIGHImproper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.EPSS 0.3%CVE-2026-11045MEDIUMInsufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the EPSS 0.3%CVE-2026-10969HIGHInsufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.3%CVE-2026-11027MEDIUMInsufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2024-25010HIGHEricsson RAN Compute and Site Controller 6610 - Improper Input Validation VulnerabilityEPSS 0.3%CVE-2020-3166MEDIUMCisco FXOS Software CLI Arbitrary File Read and Write VulnerabilityEPSS 0.3%CVE-2026-10970HIGHInsufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had comprEPSS 0.3%CVE-2026-21684HIGHiccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()EPSS 0.3%CVE-2026-21685HIGHiccDEV has Undefined Behavior in CIccTagLut16::Read()EPSS 0.3%CVE-2024-13666MEDIUMFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-SpoofingEPSS 0.3%CVE-2026-21687HIGHiccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()EPSS 0.3%CVE-2026-10981MEDIUMInsufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised tEPSS 0.3%CVE-2026-21691MEDIUMiccDEV has Type Confusion in CIccTag:IsTypeCompressed()EPSS 0.3%CVE-2026-21686HIGHiccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()EPSS 0.3%CVE-2025-24191MEDIUMThe issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to EPSS 0.3%CVE-2025-53075MEDIUMImproper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.EPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%