Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2024-25942MEDIUMDell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker couEPSS 0.2%CVE-2026-79151MEDIUMImproper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2026-17901MEDIUMInsufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypassEPSS 0.2%CVE-2026-11098MEDIUMInsufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the EPSS 0.2%CVE-2026-87469MEDIUMImproper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into aEPSS 0.2%CVE-2024-43445MEDIUMMissing X-Content-Type-Options: nosniff Header Allows MIME Type SniffingEPSS 0.2%CVE-2021-3786MEDIUMA potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be usedEPSS 0.2%CVE-2026-11287MEDIUMInsufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.2%CVE-2026-14080MEDIUMInsufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to byEPSS 0.2%CVE-2025-24504MEDIUMAn improper input validation the CSRF filter results in unsanitized user input written to the application logs.EPSS 0.2%CVE-2025-43299MEDIUMA denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, macOS Sequoia 15.7, macOSEPSS 0.2%CVE-2024-27385MEDIUMA vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 relaEPSS 0.2%CVE-2025-30648HIGHJunos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhcpd process to crashEPSS 0.2%CVE-2026-13939LOWInsufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had EPSS 0.2%CVE-2024-27386MEDIUMA vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 relaEPSS 0.2%CVE-2022-33176HIGHImproper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before versionEPSS 0.2%CVE-2021-1450MEDIUMCisco AnyConnect Secure Mobility Client Denial of Service VulnerabilityEPSS 0.2%CVE-2026-10916MEDIUMInsufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisedEPSS 0.2%CVE-2025-47888MEDIUMJenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configEPSS 0.2%CVE-2021-26370—Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allEPSS 0.2%