Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-17700MEDIUMInsufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2026-14414MEDIUMInsufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-11660HIGHInsufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had comproEPSS 0.3%CVE-2025-55058MEDIUMCWE-20 Improper Input ValidationEPSS 0.3%CVE-2025-24510HIGHA vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnetEPSS 0.3%CVE-2026-47880MEDIUMDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesEPSS 0.3%CVE-2022-1108MEDIUMA potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could beEPSS 0.3%CVE-2026-79203LOWImproper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-62656MEDIUMPost-authenticated command injection vulnerability found in certain NETGEAR RAX modelsEPSS 0.3%CVE-2026-21083MEDIUMImproper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.EPSS 0.3%CVE-2026-7966LOWInsufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had comproEPSS 0.3%CVE-2026-79066LOWImproper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2021-20297—A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highesEPSS 0.3%CVE-2026-13990MEDIUMInsufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who EPSS 0.3%CVE-2026-8369MEDIUMImproper Input Validation in OpenThread NAT64 TranslatorEPSS 0.3%CVE-2026-78943LOWImproper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2021-26316HIGHFailure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resultingEPSS 0.3%CVE-2026-7968LOWInsufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-9950LOWInsufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromiEPSS 0.3%CVE-2026-9031MEDIUMAuthenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6EPSS 0.3%