Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2022-47190CRITICALRCE via file upload vulnerability in Generex CS141EPSS 1.6%CVE-2017-12244—A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote aEPSS 1.6%CVE-2021-28585MEDIUMMagento Commerce improper input validation in customer customer webapiEPSS 1.6%CVE-2020-7841HIGHTOBESOFT XPLATFORM arbitrary hta file execution vulnerabilityEPSS 1.6%CVE-2019-1689HIGHCisco Webex Teams for iOS Arbitrary File Upload VulnerabilityEPSS 1.6%CVE-2025-34055CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.6%CVE-2025-53809MEDIUMWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.6%CVE-2019-1984MEDIUMCisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write VulnerabilityEPSS 1.6%CVE-2021-42853CRITICALDirectory Traversal Delete/Read at AgentDiagnosticServletEPSS 1.6%CVE-2021-4125—It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as EPSS 1.6%CVE-2021-42854CRITICALDirectory Traversal Read/Write/Delete at PluginServletEPSS 1.6%CVE-2018-19008—The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor whEPSS 1.6%CVE-2020-5238MEDIUMDenial of service in table parsing in cmark-gfmEPSS 1.6%CVE-2022-29243MEDIUMImproper input-size validation on the user new session name in Nextcloud ServerEPSS 1.6%CVE-2020-3441MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityEPSS 1.6%CVE-2024-37373HIGHImproper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achEPSS 1.6%CVE-2020-7842MEDIUMD'live AP command injection vulnerabilityEPSS 1.6%CVE-2018-10923HIGHIt was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated aEPSS 1.6%CVE-2018-10885MEDIUMIn atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-netwoEPSS 1.6%CVE-2020-14513—CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverEPSS 1.6%