Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-2469HIGHRemote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2020-7821HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2023-34102HIGHPossible unsafe reflection / partial denial of service in avoEPSS 1.6%CVE-2020-7820HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2021-21357HIGHBroken Access Control in Form FrameworkEPSS 1.6%CVE-2021-3524—A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the iEPSS 1.6%CVE-2017-12300—A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aEPSS 1.6%CVE-2019-7589CRITICALKantech EntraPass Improper Input ValidationEPSS 1.6%CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2023-25691CRITICALApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2019-19279—A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versioEPSS 1.6%CVE-2022-36125HIGHInteger overflow when reading corrupted .avro file in Avro Rust SDKEPSS 1.6%CVE-2018-15425—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.6%CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2023-37415HIGHApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userEPSS 1.6%CVE-2018-0394—A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain resEPSS 1.6%CVE-2024-34693MEDIUMApache Superset: Server arbitrary file readEPSS 1.6%CVE-2022-47190CRITICALRCE via file upload vulnerability in Generex CS141EPSS 1.6%