Falhas do tipo CWE-20

5.385 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-47175HIGHlibppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD bufferEPSS 63.6%CVE-2020-3251CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 61.5%CVE-2020-3250CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 60.9%CVE-2024-48914CRITICALVendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS 60.4%CVE-2020-3495CRITICALCisco Jabber for Windows Message Handling Arbitrary Code Execution VulnerabilityEPSS 59.9%CVE-2021-34427—In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curreEPSS 58.0%CVE-2023-5044HIGHCode injection via nginx.ingress.kubernetes.io/permanent-redirect annotationEPSS 56.6%CVE-2019-11708CRITICALInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeEPSS 55.9%KEVCVE-2022-29499CRITICALThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.EPSS 55.6%KEVCVE-2018-0125CRITICALA vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unautEPSS 55.2%KEVCVE-2023-39456HIGHApache Traffic Server: Malformed http/2 frames can cause an abortEPSS 53.8%CVE-2019-1068HIGHA remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'MicrEPSS 52.8%KEVCVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.3%CVE-2023-3710CRITICALPrinter web page invalid command executionEPSS 49.0%CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.7%CVE-2024-45802HIGHSquid Denial of ServiceEPSS 47.9%CVE-2022-46768MEDIUMFile name information disclosure vulnerability in Zabbix Web Service Report GenerationEPSS 47.8%CVE-2023-44355MEDIUMColdFusion | Improper Input Validation (CWE-20)EPSS 47.2%CVE-2023-4357HIGHInsufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access reEPSS 47.1%