Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2018-15422—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2019-11255MEDIUMKubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutationEPSS 2.0%CVE-2021-36044HIGHMagento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceEPSS 2.0%CVE-2021-36021HIGHMagento Commerce CMS Page Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.0%CVE-2018-0299—A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow anEPSS 2.0%CVE-2021-37909CRITICALCHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input ValidationEPSS 2.0%CVE-2018-0291—A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticatedEPSS 2.0%CVE-2023-30631—Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workEPSS 2.0%CVE-2022-47185HIGHApache Traffic Server: Invalid Range header causes a crashEPSS 2.0%CVE-2021-40120MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilityEPSS 2.0%CVE-2018-0248MEDIUMCisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesEPSS 2.0%CVE-2019-10190MEDIUMA vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers tEPSS 2.0%CVE-2021-44040—HTTP request line fuzzing attacksEPSS 2.0%CVE-2011-10008HIGHMPlayer Lite r33064 M3U Stack-Based Buffer OverflowEPSS 2.0%CVE-2014-2653MEDIUMThe verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFPEPSS 2.0%CVE-2023-38156HIGHAzure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityEPSS 2.0%CVE-2019-1964HIGHCisco NX-OS Software IPv6 Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12653HIGHCisco IOS XE Software Raw Socket Transport Denial of Service VulnerabilityEPSS 2.0%CVE-2014-125119HIGHWinRAR < 5.00 Filename Spoofing RCEEPSS 2.0%CVE-2019-1962HIGHCisco NX-OS Software Cisco Fabric Services over IP Denial of Service VulnerabilityEPSS 2.0%