Fallos del tipo CWE-20

5419 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2019-12626MEDIUMCisco Unified Contact Center Express Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-24695MEDIUM Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationEPSS 0.8%CVE-2022-21197HIGHImproper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of EPSS 0.8%CVE-2024-6973HIGHRemote Code Execution in Cato Windows SDP client via crafted URLsEPSS 0.8%CVE-2024-24696MEDIUMZoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationEPSS 0.8%CVE-2023-36872MEDIUMVP9 Video Extensions Information Disclosure VulnerabilityEPSS 0.8%CVE-2021-31375HIGHJunos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassedEPSS 0.8%CVE-2020-1727MEDIUMA vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validationEPSS 0.8%CVE-2020-15233MEDIUMOAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesEPSS 0.8%CVE-2025-57220MEDIUMAn input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafEPSS 0.8%CVE-2020-16099MEDIUMIn Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like repEPSS 0.8%CVE-2023-27483MEDIUMfieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtimeEPSS 0.8%CVE-2023-26159HIGHVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by tEPSS 0.8%CVE-2019-1920HIGHCisco IOS Access Points Software 802.11r Fast Transition Denial of Service VulnerabilityEPSS 0.8%CVE-2023-2942HIGHImproper Input Validation in openemr/openemrEPSS 0.8%CVE-2025-68398CRITICALWeblate has git config file overwrite vulnerability that leads to remote code executionEPSS 0.8%CVE-2024-30258HIGHFastDDS crash when publisher send malformed packetEPSS 0.8%CVE-2026-46456CRITICALApache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headersEPSS 0.8%CVE-2021-41168MEDIUMHash-Collision Denial-of-Service Vulnerability in snudownEPSS 0.8%CVE-2024-32672MEDIUMA Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of serEPSS 0.8%