Fallos del tipo CWE-20

5384 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2025-1098HIGHingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS 83.5%CVE-2023-2915HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 81.8%CVE-2025-34300CRITICALSawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCEEPSS 79.2%CVE-2026-21858CRITICALn8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingEPSS 78.4%CVE-2024-47076HIGHlibcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP serverEPSS 77.6%CVE-2023-36899HIGHASP.NET Elevation of Privilege VulnerabilityEPSS 76.7%CVE-2024-22120CRITICALTime Based SQL Injection in Zabbix Server Audit LogEPSS 76.6%CVE-2020-3247CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 75.6%CVE-2020-3248CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 74.4%CVE-2018-8414HIGHA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code ExEPSS 74.0%KEVCVE-2020-3239CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 73.6%CVE-2023-2917CRITICALRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 72.2%CVE-2012-1535HIGHUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote aEPSS 70.4%KEVCVE-2020-13942—Remote Code Execution in Apache UnomiEPSS 68.4%CVE-2023-24950MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 67.5%CVE-2018-16873HIGHIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag andEPSS 66.3%CVE-2019-12630MEDIUMCisco Security Manager Java Deserialization VulnerabilityEPSS 65.8%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2022-0415CRITICALRemote Command Execution in uploading repository file in gogs/gogsEPSS 65.2%CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.6%