Fallos del tipo CWE-20

5456 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2022-26006HIGHImproper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of EPSS 0.2%CVE-2025-5148MEDIUMFunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserializationEPSS 0.2%CVE-2026-40317CRITICALNovumOS has Privilege Escalation in the Syscall InterfaceEPSS 0.2%CVE-2026-56732MEDIUMZammad: Malicious input in Ticket Body Enables Session TerminationEPSS 0.2%CVE-2024-25116MEDIUMSpecially crafted CF.RESERVE command can lead to denial-of-serviceEPSS 0.2%CVE-2025-43482MEDIUMThe issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. EPSS 0.2%CVE-2022-45469LOWImproper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via lEPSS 0.2%CVE-2025-4701MEDIUMVITA-MLLM Freeze-Omni utils.py torch.load deserializationEPSS 0.2%CVE-2026-25684MEDIUMFile Type Control rule bypassEPSS 0.2%CVE-2024-0080LOW NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specEPSS 0.2%CVE-2025-4742MEDIUMXU-YIJIE grpo-flat grpo_vanilla.py main deserializationEPSS 0.2%CVE-2025-4740MEDIUMBeamCtrl Airiana coef deserializationEPSS 0.2%CVE-2023-22662MEDIUMImproper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user tEPSS 0.2%CVE-2026-24347MEDIUMArbitrary file write to /tmp directory in EZCast Pro II DongleEPSS 0.2%CVE-2022-32577LOWImproper input validation in BIOS Firmware for some Intel(R) NUC Kits before version PY0081 may allow a privileged user to potentially enablEPSS 0.2%CVE-2024-22390MEDIUMImproper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.EPSS 0.2%CVE-2026-45055HIGHCubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host HeaderEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2026-13812MEDIUMInsufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who coEPSS 0.2%CVE-2026-11213CRITICALInsufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromEPSS 0.2%