Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2024-2469HIGHRemote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceEPSS 1.6%CVE-2021-1304HIGHCisco SD-WAN vManage Authorization Bypass VulnerabilitiesEPSS 1.6%CVE-2021-3524—A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the iEPSS 1.6%CVE-2020-7821HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2020-7820HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2020-27824—A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafteEPSS 1.6%CVE-2023-34102HIGHPossible unsafe reflection / partial denial of service in avoEPSS 1.6%CVE-2022-43439CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0EPSS 1.6%CVE-2021-21357HIGHBroken Access Control in Form FrameworkEPSS 1.6%CVE-2020-11261HIGHMemory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, EPSS 1.6%KEVCVE-2017-12300—A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aEPSS 1.6%CVE-2019-7589CRITICALKantech EntraPass Improper Input ValidationEPSS 1.6%CVE-2021-1431HIGHCisco IOS XE SD-WAN Software vDaemon Denial of Service VulnerabilityEPSS 1.6%CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2023-25691CRITICALApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2022-36085HIGHOPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functionsEPSS 1.6%CVE-2019-19279—A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versioEPSS 1.6%CVE-2018-15425—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.6%CVE-2023-37415HIGHApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userEPSS 1.6%