Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2021-1263HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.5%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.5%CVE-2019-1951MEDIUMCisco SD-WAN Solution Packet Filtering Bypass VulnerabilityEPSS 1.5%CVE-2023-35303HIGHUSB Audio Class System Driver Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-24893HIGHopenITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro ExpansionEPSS 1.5%CVE-2022-32154MEDIUMRisky commands warnings in Splunk Enterprise DashboardsEPSS 1.5%CVE-2022-24774HIGHImproper Input Validation leading to Path Traversal in CycloneDX BOM Repository ServerEPSS 1.5%CVE-2022-24280MEDIUMApache Pulsar Proxy target broker address isn't validatedEPSS 1.5%CVE-2023-49291CRITICALImproper Sanitization of Branch Name Leads to Arbitrary Code InjectionEPSS 1.4%CVE-2021-1261HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2021-1260HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2020-7839HIGHMarkAny MaEPSBroker Command Injection VulnerabilityEPSS 1.4%CVE-2026-77533CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtEPSS 1.4%CVE-2026-77546CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2026-77543CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2026-77548CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtEPSS 1.4%CVE-2017-7653—The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other cliEPSS 1.4%CVE-2026-77547CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2021-23862HIGHAuthenticated Remote Code ExecutionEPSS 1.4%CVE-2025-25005MEDIUMMicrosoft Exchange Server Tampering VulnerabilityEPSS 1.4%