Fallos del tipo CWE-20

5399 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2018-15421—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2021-36044HIGHMagento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceEPSS 2.0%CVE-2021-36021HIGHMagento Commerce CMS Page Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.0%CVE-2021-37909CRITICALCHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input ValidationEPSS 2.0%CVE-2023-30631—Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workEPSS 2.0%CVE-2022-47185HIGHApache Traffic Server: Invalid Range header causes a crashEPSS 2.0%CVE-2021-40120MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilityEPSS 2.0%CVE-2022-24723MEDIUMImproper Input Validation in URI.jsEPSS 2.0%CVE-2018-0248MEDIUMCisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesEPSS 2.0%CVE-2019-10190MEDIUMA vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers tEPSS 2.0%CVE-2021-44040—HTTP request line fuzzing attacksEPSS 2.0%CVE-2014-2653MEDIUMThe verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFPEPSS 2.0%CVE-2023-38156HIGHAzure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityEPSS 2.0%CVE-2019-1964HIGHCisco NX-OS Software IPv6 Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12653HIGHCisco IOS XE Software Raw Socket Transport Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12657HIGHCisco IOS XE Software Unified Threat Defense Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1962HIGHCisco NX-OS Software Cisco Fabric Services over IP Denial of Service VulnerabilityEPSS 2.0%CVE-2023-25696CRITICALApache Airflow Hive Provider Beeline RCEEPSS 2.0%CVE-2021-29486HIGHImproper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionEPSS 2.0%CVE-2018-0298—A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to caEPSS 2.0%