Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2020-27828—There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitraryEPSS 1.4%CVE-2018-10843HIGHsource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to EPSS 1.4%CVE-2017-2653MEDIUMA number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesEPSS 1.4%CVE-2024-46946CRITICALlangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through syEPSS 1.4%CVE-2019-1905MEDIUMCisco Email Security Appliance GZIP Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2024-34109HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 1.4%CVE-2022-25751—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.4%CVE-2024-45169CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.4%CVE-2018-7531—An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidaEPSS 1.4%CVE-2026-93952CRITICALSecurity Advisory 0183EPSS 1.4%KEVCVE-2021-41138MEDIUMValidity check for signed Frontier-specific extrinsic not called in block executionEPSS 1.4%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.4%CVE-2020-3133MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-7014HIGHImproper multimedia file attachment validation in Telegram for Android appEPSS 1.4%CVE-2019-15289HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilitiesEPSS 1.4%CVE-2019-15261HIGHCisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3526HIGHCisco IOS XE Software Common Open Policy Service Engine Denial of Service VulnerabilityEPSS 1.4%CVE-2018-0438—Cisco Umbrella Enterprise Roaming Client Privilege Escalation VulnerabilityEPSS 1.4%CVE-2020-3527HIGHCisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service VulnerabilityEPSS 1.4%