Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2019-12657HIGHCisco IOS XE Software Unified Threat Defense Denial of Service VulnerabilityEPSS 2.0%CVE-2023-25696CRITICALApache Airflow Hive Provider Beeline RCEEPSS 2.0%CVE-2021-29486HIGHImproper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionEPSS 2.0%CVE-2021-45116HIGHAn issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template LanguageEPSS 2.0%CVE-2020-10289HIGHRVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132EPSS 2.0%CVE-2018-0298—A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to caEPSS 2.0%CVE-2018-10930MEDIUMA flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destiEPSS 2.0%CVE-2019-12655HIGHCisco IOS XE Software FTP Application Layer Gateway for NAT, NAT64, and ZBFW Denial of Service VulnerabilityEPSS 2.0%CVE-2022-39312CRITICALDataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityEPSS 2.0%CVE-2021-21404HIGHCrash due to malformed relay protocol messageEPSS 2.0%CVE-2026-32203HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.0%CVE-2020-36332—A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threaEPSS 2.0%CVE-2017-3846—A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticateEPSS 2.0%CVE-2020-9743MEDIUMHTML injection in AEM's content editor componentEPSS 2.0%CVE-2018-15428—Cisco IOS XR Software Border Gateway Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2021-20273—A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.EPSS 2.0%CVE-2021-23192—A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragmenEPSS 2.0%CVE-2020-8187—Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform EPSS 1.9%CVE-2020-7069MEDIUMWrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVEPSS 1.9%CVE-2025-34116HIGHIPFire < 2.19 Core Update 101 proxy.cgi RCEEPSS 1.9%