Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-21271HIGHDreamweaver Desktop | Improper Input Validation (CWE-20)EPSS 0.2%CVE-2025-67480NONElist=allrevisions can be used to bypass Extension:LockdownEPSS 0.2%CVE-2026-21268HIGHDreamweaver Desktop | Improper Input Validation (CWE-20)EPSS 0.2%CVE-2022-33894HIGHImproper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of EPSS 0.2%CVE-2022-28196MEDIUMNVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusteEPSS 0.2%CVE-2026-79000MEDIUMImproper input validation in DeviceBoundSessionCredentials in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging sociEPSS 0.2%CVE-2025-64747MEDIUMDirectus Vulnerable to Stored Cross-site ScriptingEPSS 0.2%CVE-2021-26323—Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.EPSS 0.2%CVE-2026-60620MEDIUMVulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supportEPSS 0.2%CVE-2026-79272LOWImproper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pEPSS 0.2%CVE-2022-28195MEDIUMNVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrustedEPSS 0.2%CVE-2026-7965LOWInsufficient validation of untrusted input in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromisedEPSS 0.2%CVE-2026-12009HIGHInsufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who haEPSS 0.2%CVE-2021-25441—Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applicatiEPSS 0.2%CVE-2026-13865MEDIUMInsufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoEPSS 0.2%CVE-2026-14140MEDIUMInsufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform EPSS 0.2%CVE-2025-12741HIGHArbitrary File Write in Denodo dialect of Looker allows Remote Code ExecutionEPSS 0.2%CVE-2026-14089MEDIUMInsufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromEPSS 0.2%CVE-2021-25504MEDIUMIntent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.EPSS 0.2%CVE-2026-17794MEDIUMInsufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had coEPSS 0.2%