Falhas do tipo CWE-20

5.888 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-46929HIGHAn issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:EPSS 0.8%CVE-2024-25131HIGHOpenshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalationEPSS 0.8%CVE-2021-41250MEDIUMPresence of non-blacklisted URL bypasses all other filtersEPSS 0.8%CVE-2021-39230HIGHError in JPNS kernel of ButterEPSS 0.8%CVE-2023-32075MEDIUMPimcore vulnerable to Business Logic Errors in Customer automation rulesEPSS 0.8%CVE-2024-38243HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-4427MEDIUMSQL Injection via OTRS Search APIEPSS 0.8%CVE-2018-19010—Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. AEPSS 0.8%CVE-2022-29492MEDIUMA vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...EPSS 0.8%CVE-2017-3849—A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and CiEPSS 0.8%CVE-2023-32890MEDIUMIn modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additioEPSS 0.8%CVE-2026-23571MEDIUMCommand Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEXEPSS 0.8%CVE-2023-49551HIGHAn issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.EPSS 0.8%CVE-2024-52802HIGHRIOT-OS missing dhcpv6_opt_t minimum header length checkEPSS 0.8%CVE-2022-4033MEDIUMQuiz and Survey Master <= 8.0.4 - Improper Input ValidationEPSS 0.8%CVE-2022-34851MEDIUMBIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851EPSS 0.8%CVE-2023-48608LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.8%CVE-2023-27496MEDIUMEnvoy may crash when a redirect url without a state param is received in the oauth filterEPSS 0.8%CVE-2021-25444—An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process.EPSS 0.8%CVE-2023-5571MEDIUMImproper Input Validation in vriteio/vriteEPSS 0.8%