Fallos del tipo CWE-20

5410 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2023-36697MEDIUMMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 2.1%CVE-2019-18995MEDIUMABB PB610 HMISimulator does not check content-length of the HTTP requestEPSS 2.1%CVE-2017-12328—A vulnerability in Session Initiation Protocol (SIP) call handling in Cisco IP Phone 8800 Series devices could allow an unauthenticated, remEPSS 2.1%CVE-2017-12217—A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture EEPSS 2.1%CVE-2021-1404HIGHClam AntiVirus (ClamAV) Email Parser Denial of Service VulnerabilityEPSS 2.1%CVE-2021-28170—In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be EPSS 2.1%CVE-2018-15408—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15414—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15417—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15412—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15415—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15413—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15420—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2018-15416—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.1%CVE-2024-6089HIGHRockwell Automation Major nonrecoverable fault in 5015 – AENFTXTEPSS 2.1%CVE-2018-10891MEDIUMA flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the questEPSS 2.1%CVE-2021-33592—NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in fileEPSS 2.1%CVE-2018-10930MEDIUMA flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destiEPSS 2.1%CVE-2020-3225HIGHCisco IOS and IOS XE Software Common Industrial Protocol Denial of Service VulnerabilitiesEPSS 2.1%CVE-2024-26164HIGHMicrosoft Django Backend for SQL Server Remote Code Execution VulnerabilityEPSS 2.1%