Falhas do tipo CWE-20

5.393 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2018-15411—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15418—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15422—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15421—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15419—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15410—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2021-36044HIGHMagento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceEPSS 2.0%CVE-2021-36021HIGHMagento Commerce CMS Page Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.0%CVE-2021-37909CRITICALCHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input ValidationEPSS 2.0%CVE-2023-30631—Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workEPSS 2.0%CVE-2022-47185HIGHApache Traffic Server: Invalid Range header causes a crashEPSS 2.0%CVE-2021-40120MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilityEPSS 2.0%CVE-2022-24723MEDIUMImproper Input Validation in URI.jsEPSS 2.0%CVE-2018-0248MEDIUMCisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesEPSS 2.0%CVE-2019-10190MEDIUMA vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers tEPSS 2.0%CVE-2021-44040—HTTP request line fuzzing attacksEPSS 2.0%CVE-2014-2653MEDIUMThe verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFPEPSS 2.0%CVE-2023-38156HIGHAzure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityEPSS 2.0%CVE-2019-1964HIGHCisco NX-OS Software IPv6 Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12653HIGHCisco IOS XE Software Raw Socket Transport Denial of Service VulnerabilityEPSS 2.0%