Fallos del tipo CWE-20

5455 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2024-45441MEDIUMInput verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availabilityEPSS 0.2%CVE-2022-32492HIGHDell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerabiliEPSS 0.2%CVE-2022-32486HIGHDell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerabiliEPSS 0.2%CVE-2021-31360HIGHJunos OS and Junos OS Evolved: Denial of Service vulnerability in local file processingEPSS 0.2%CVE-2025-54327MEDIUMAn issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper inputEPSS 0.2%CVE-2026-12017LOWInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2020-10054—A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application does not properly handEPSS 0.2%CVE-2025-4680HIGHImproper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured AccEPSS 0.2%CVE-2024-31153MEDIUMImproper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentiaEPSS 0.2%CVE-2022-24379HIGHImproper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user tEPSS 0.2%CVE-2026-21060MEDIUMImproper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user EPSS 0.2%CVE-2025-21477HIGHImproper Input Validation in ModemEPSS 0.2%CVE-2023-39411MEDIUMImproper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local EPSS 0.2%CVE-2026-11244LOWInsufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had coEPSS 0.2%CVE-2024-54121MEDIUMStartup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnoEPSS 0.2%CVE-2026-21070MEDIUMImproper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.EPSS 0.2%CVE-2025-58759MEDIUMTinyEnv: Inline comments not stripped properly in .env valuesEPSS 0.2%CVE-2023-39537HIGHImproper input validation in BIOS TCG2EPSS 0.2%CVE-2023-39535HIGHImproper input validation in BIOS EPSS 0.2%CVE-2025-65264MEDIUMThe kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attackEPSS 0.2%