Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 1.6%CVE-2022-24423MEDIUMDell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially explEPSS 1.6%CVE-2021-25436—Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via EPSS 1.6%CVE-2023-38254MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12218—A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeEPSS 1.6%CVE-2026-77554CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exeEPSS 1.6%CVE-2026-77552CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video EPSS 1.6%CVE-2026-77537CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to EPSS 1.6%CVE-2021-43762MEDIUMAdobe Experience Manager Unicode normalization leads to dispatcher bypassEPSS 1.6%CVE-2021-1508CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2021-1505CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2026-50748CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.6%CVE-2021-21322CRITICALPrefix escapeEPSS 1.6%CVE-2022-43546CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.6%CVE-2020-25717—A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilegEPSS 1.6%CVE-2020-7869CRITICALAn improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fEPSS 1.6%CVE-2018-10885MEDIUMIn atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-netwoEPSS 1.6%CVE-2021-21060MEDIUMAcrobat Pro DC Improper File Parsing Could Lead to Information DisclosureEPSS 1.6%CVE-2022-3294MEDIUMNode address isn't always verified when proxyingEPSS 1.6%