Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2022-36087MEDIUMOAuthLib vulnerable DoS when attacker provides malicious IPV6 URIEPSS 1.7%CVE-2018-10923HIGHIt was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated aEPSS 1.7%CVE-2020-3230HIGHCisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service VulnerabilityEPSS 1.7%CVE-2018-19005—Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing EPSS 1.7%CVE-2020-3516MEDIUMCisco IOS XE Software Web UI Improper Input Validation VulnerabilityEPSS 1.7%CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2017-6021—In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, EPSS 1.7%CVE-2024-49057HIGHMicrosoft Defender for Endpoint on Android Spoofing VulnerabilityEPSS 1.7%CVE-2024-55020CRITICALA command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attEPSS 1.7%CVE-2019-1720MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.7%CVE-2020-27833—A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafEPSS 1.7%CVE-2022-20797MEDIUMCisco Secure Network Analytics Remote Code Execution VulnerabilityEPSS 1.7%CVE-2020-7880HIGHdouzone NeoRS remote support program ActiveX vulnerabilityEPSS 1.7%CVE-2025-47171MEDIUMMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 1.7%CVE-2023-27604HIGHApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2020-8124—Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasEPSS 1.7%CVE-2011-10008HIGHMPlayer Lite r33064 M3U Stack-Based Buffer OverflowEPSS 1.7%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%