Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2025-34056CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.9%CVE-2021-20247—A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malEPSS 1.9%CVE-2022-43545CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.9%CVE-2020-16227—Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project EPSS 1.9%CVE-2021-26607HIGHTOBESOFT NEXACRO17 arbitrary command execution vulnerabilityEPSS 1.9%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%CVE-2023-39913HIGHApache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formatsEPSS 1.9%CVE-2019-1983HIGHCisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service VulnerabilityEPSS 1.9%CVE-2018-15409—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 1.9%CVE-2026-18911HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send reqEPSS 1.9%CVE-2020-3191HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPv6 DNS Denial of Service VulnerabilityEPSS 1.9%CVE-2022-47391HIGHCODESYS: Multiple products prone to Improper Input ValidationEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%CVE-2018-10888—A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound EPSS 1.8%CVE-2020-3228MEDIUMCisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Service VulnerabilityEPSS 1.8%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2019-1788HIGHClamAV OLE2 File Out-Of-Bounds Write VulnerabilityEPSS 1.8%CVE-2024-55020CRITICALA command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attEPSS 1.8%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2019-12669MEDIUMCisco IOS and IOS XE Software Change of Authorization Denial of Service VulnerabilityEPSS 1.8%