Fallos del tipo CWE-20

5456 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2022-43848MEDIUMIBM AIX denial of serviceEPSS 0.2%CVE-2026-21503MEDIUMiccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArrayEPSS 0.2%CVE-2026-21497MEDIUMNULL Pointer Dereference in iccDEV Unknown Tag ParserEPSS 0.2%CVE-2025-62525HIGHOpenWrt vulnerable to local privilage escalationEPSS 0.2%CVE-2026-11199MEDIUMInappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to leak EPSS 0.2%CVE-2026-21506MEDIUMiccDEV is Vulnerable to Null Pointer Dereference in CIccProfileXml::ParseBasic() Leading to Denial of ServiceEPSS 0.2%CVE-2026-17414HIGHPower System Improper Input ValidationEPSS 0.2%CVE-2022-20470HIGHIn bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input vEPSS 0.2%CVE-2026-21499MEDIUMNULL Pointer Dereference in iccDEV XML ParserEPSS 0.2%CVE-2025-50674HIGHAn issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowingEPSS 0.2%CVE-2023-0615MEDIUMA memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. TEPSS 0.2%CVE-2022-4573MEDIUM An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privilegEPSS 0.2%CVE-2026-21498MEDIUMNULL Pointer Dereference in iccDEV XML Calculator ParserEPSS 0.2%CVE-2026-21496MEDIUMNULL Pointer Dereference in iccDEV Signature ParserEPSS 0.2%CVE-2026-21502MEDIUMNULL Pointer Dereference in iccDEV XML Tag ParserEPSS 0.2%CVE-2024-27378MEDIUMAn issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_EPSS 0.2%CVE-2024-36282HIGHImproper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged EPSS 0.2%CVE-2026-18261MEDIUMPowerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092EPSS 0.2%CVE-2023-32617HIGHImproper input validation in some Intel(R) NUC Rugged Kit, Intel(R) NUC Kit and Intel(R) Compute Element BIOS firmware may allow a privilegeEPSS 0.2%CVE-2023-34086HIGHImproper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via lEPSS 0.2%