Falhas do tipo CWE-20

5.396 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2020-8124—Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasEPSS 1.7%CVE-2011-10008HIGHMPlayer Lite r33064 M3U Stack-Based Buffer OverflowEPSS 1.7%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 1.6%CVE-2019-1831MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.6%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2022-24423MEDIUMDell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially explEPSS 1.6%CVE-2021-25436—Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via EPSS 1.6%CVE-2023-38254MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12218—A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeEPSS 1.6%CVE-2021-43762MEDIUMAdobe Experience Manager Unicode normalization leads to dispatcher bypassEPSS 1.6%CVE-2021-1505CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2021-1508CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2026-50748CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.6%CVE-2021-21322CRITICALPrefix escapeEPSS 1.6%CVE-2020-25717—A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilegEPSS 1.6%CVE-2022-43546CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.6%CVE-2020-7869CRITICALAn improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fEPSS 1.6%CVE-2022-20797MEDIUMCisco Secure Network Analytics Remote Code Execution VulnerabilityEPSS 1.6%