Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2021-25436—Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via EPSS 1.6%CVE-2021-28655MEDIUMApache Zeppelin: Arbitrary file deletion vulnerabilityEPSS 1.6%CVE-2021-21060MEDIUMAcrobat Pro DC Improper File Parsing Could Lead to Information DisclosureEPSS 1.6%CVE-2023-38254MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12218—A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeEPSS 1.6%CVE-2021-30004MEDIUMIn wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x5EPSS 1.6%CVE-2021-1304HIGHCisco SD-WAN vManage Authorization Bypass VulnerabilitiesEPSS 1.6%CVE-2026-77554CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exeEPSS 1.6%CVE-2017-6021—In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, EPSS 1.6%CVE-2026-77537CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to EPSS 1.6%CVE-2026-77552CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video EPSS 1.6%CVE-2021-1508CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2021-1505CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2026-50748CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.6%CVE-2022-36085HIGHOPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functionsEPSS 1.6%CVE-2021-21322CRITICALPrefix escapeEPSS 1.6%CVE-2026-28336CRITICALSolarWinds Dameware Command Injection VulnerabilityEPSS 1.6%CVE-2020-25717—A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilegEPSS 1.6%CVE-2020-7869CRITICALAn improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fEPSS 1.6%CVE-2022-3294MEDIUMNode address isn't always verified when proxyingEPSS 1.6%