Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2016-8651LOWAn input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with aEPSS 1.4%CVE-2020-15174HIGHUnpreventable top-level navigation in ElectronEPSS 1.4%CVE-2020-3358HIGHCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Denial of Service VulnerabilityEPSS 1.4%CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.4%CVE-2023-39532CRITICALSES's dynamic import and spread operator provides possible path to arbitrary exfiltration and executionEPSS 1.3%CVE-2021-1262HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.3%CVE-2019-1886HIGHCisco Web Security Appliance HTTPS Certificate Denial of Service VulnerabilityEPSS 1.3%CVE-2021-32642HIGHMissing input validation in dynamic discovery example scripts.EPSS 1.3%CVE-2020-28590HIGHAn out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master CEPSS 1.3%CVE-2022-3001HIGHVulnerability in Milesight Video Management Systems (VMS)EPSS 1.3%CVE-2021-40423HIGHA denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A spEPSS 1.3%CVE-2023-30446MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2023-30447MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2021-32759HIGHData Flow Sanitation Issue FixEPSS 1.3%CVE-2021-1464MEDIUMCisco SD-WAN vManage Authorization Bypass VulnerabilityEPSS 1.3%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.3%CVE-2021-42787CRITICALDirectory Traversal Write/Delete/Partial Read at AgentConfigurationServletEPSS 1.3%CVE-2022-47894MEDIUMApache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXEEPSS 1.3%CVE-2024-41117CRITICALRemote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.pyEPSS 1.3%CVE-2024-41116CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_paramsEPSS 1.3%