Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2021-33592—NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in fileEPSS 2.1%CVE-2024-26164HIGHMicrosoft Django Backend for SQL Server Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-27660HIGHC-CURE 9000EPSS 2.1%CVE-2021-21705MEDIUMIncorrect URL validation in FILTER_VALIDATE_URLEPSS 2.1%CVE-2021-21267HIGHRegular Expression Denial-of-Service in npm schema-inspectorEPSS 2.1%CVE-2021-42786CRITICALRemote Code Execution at AgentControllerServletEPSS 2.1%CVE-2024-2443CRITICALImproper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleEPSS 2.1%CVE-2020-15258HIGHInsecure use of shell.openExternal in WireEPSS 2.1%CVE-2023-24937MEDIUMWindows CryptoAPI Denial of Service VulnerabilityEPSS 2.1%CVE-2018-14631HIGHmoodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumEPSS 2.1%CVE-2022-43546CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 2.1%CVE-2017-16753—An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause EPSS 2.1%CVE-2026-47928CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 2.1%CVE-2019-11781MEDIUMImproper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackeEPSS 2.1%CVE-2021-25742HIGHIngress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesEPSS 2.1%CVE-2023-32462CRITICAL Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authenticatioEPSS 2.1%CVE-2019-18228—Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HEPSS 2.1%CVE-2023-36912HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.1%CVE-2021-1275CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.1%CVE-2018-10891MEDIUMA flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the questEPSS 2.1%