Fallos del tipo CWE-20

5386 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2020-12029CRITICALRockwell Automation FactoryTalk View SEEPSS 47.0%CVE-2024-20017CRITICALIn wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no EPSS 46.6%CVE-2019-15276HIGHCisco Wireless LAN Controller HTTP Parsing Engine Denial of Service VulnerabilityEPSS 46.3%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 44.8%CVE-2026-32201MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 43.4%KEVCVE-2023-21818HIGHWindows Secure Channel Denial of Service VulnerabilityEPSS 43.2%CVE-2018-25031MEDIUMSwagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attEPSS 42.3%CVE-2026-12569CRITICALRemote Code Execution (RCE) vulnerability in Windchill PDMlinkEPSS 40.6%KEVCVE-2023-2914HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyEPSS 39.9%CVE-2013-6282HIGHThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addEPSS 39.7%KEVCVE-2019-1936HIGHCisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection VulnerabilityEPSS 39.5%CVE-2020-3240CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 38.7%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2022-28127HIGHA data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted networkEPSS 37.9%CVE-2023-26067HIGHCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).EPSS 37.8%CVE-2017-12285—A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbEPSS 37.2%CVE-2024-39573HIGHApache HTTP Server: mod_rewrite proxy handler substitutionEPSS 37.2%CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-22476CRITICALImproper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially EPSS 36.0%CVE-2025-1097HIGHingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationEPSS 35.5%