Fallos del tipo CWE-20

5417 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2020-15099HIGHExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSEPSS 1.8%CVE-2014-2345—COPA-DATA zenon DNP3 Improper Input ValidationEPSS 1.8%CVE-2019-1891HIGHCisco Small Business Series Switches HTTP Denial of Service VulnerabilityEPSS 1.8%CVE-2019-1817HIGHCisco Web Security Appliance Malformed Request Denial of Service VulnerabilityEPSS 1.8%CVE-2023-35365CRITICALWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2019-1968MEDIUMCisco NX-OS Software NX-API Denial of Service VulnerabilityEPSS 1.8%CVE-2020-3309MEDIUMCisco Firepower Device Manager On-Box Software Arbitrary File Overwrite VulnerabilityEPSS 1.8%CVE-2020-36195CRITICALSQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnEPSS 1.8%CVE-2026-54402CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS tEPSS 1.8%CVE-2020-3471MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure VulnerabilityEPSS 1.8%CVE-2020-27125HIGHCisco Security Manager Static Credential VulnerabilityEPSS 1.8%CVE-2024-30054MEDIUMMicrosoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityEPSS 1.7%CVE-2020-3302MEDIUMCisco Firepower Management Center File Overwrite VulnerabilityEPSS 1.7%CVE-2017-2617HIGHhawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a craEPSS 1.7%CVE-2025-34132CRITICALLILIN DVR Command Injection via NTPUpdate in dvr_boxEPSS 1.7%CVE-2019-15288HIGHCisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation VulnerabilityEPSS 1.7%CVE-2018-12479MEDIUMRequest controller allows to create requests with arbitrary request IDsEPSS 1.7%CVE-2020-3170MEDIUMCisco NX-OS Software NX-API Denial of Service VulnerabilityEPSS 1.7%CVE-2018-15449MEDIUMCisco Video Surveillance Media Server Denial of Service VulnerabilityEPSS 1.7%CVE-2024-3646HIGHCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleEPSS 1.7%