Sign in Sign up
JA · EN · FR
SecPulse

Cwe 20

🧬 CWE Related 2,856
slug: cwe-20

Explanation

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。 非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。 「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。
📌 Example
多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,857

Image ID Title
CVE-2016-9380 Vulnerability in Citrix Xen (CVE-2016-9380)
CVE-2016-9383 Vulnerability in Citrix Xen (CVE-2016-9383)
CVE-2016-9385 Vulnerability in Citrix Xen (CVE-2016-9385)
CVE-2016-4793 Vulnerability in Cakephp (CVE-2016-4793)
CVE-2016-5119 Vulnerability in Keepass (CVE-2016-5119)
CVE-2014-9754 Vulnerability in Viprinet (CVE-2014-9754)
CVE-2014-9755 Vulnerability in Viprinet (CVE-2014-9755)
CVE-2016-9435 Vulnerability in Opensuse (CVE-2016-9435)
CVE-2016-9436 Vulnerability in Opensuse (CVE-2016-9436)
CVE-2017-2576 In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
CVE-2015-8212 Vulnerability in Netbsd (CVE-2015-8212)
CVE-2016-7543 Vulnerability in Gnu Bash (CVE-2016-7543)
CVE-2016-5197 Vulnerability in Google Chrome (CVE-2016-5197)
CVE-2016-5218 Vulnerability in Google Chrome (CVE-2016-5218)
CVE-2016-5222 Vulnerability in Google Chrome (CVE-2016-5222)
CVE-2016-7998 Vulnerability in Spip (CVE-2016-7998)
CVE-2016-9278 Vulnerability in Samsung Exynos Fimg2D Driver (CVE-2016-9278)
CVE-2016-7431 Vulnerability in Ntp (CVE-2016-7431)
CVE-2016-7434 Vulnerability in Ntp (CVE-2016-7434)
CVE-2016-9158 Vulnerability in Siemens Simatic S7 300 Cpu Firmware (CVE-2016-9158)
CVE-2016-3092 Vulnerability in Apache Tomcat (CVE-2016-3092)
CVE-2016-1182 Vulnerability in Apache Struts (CVE-2016-1182)
CVE-2016-0025 Vulnerability in Microsoft Office (CVE-2016-0025)
CVE-2015-6563 Vulnerability in OpenBSD Openssh (CVE-2015-6563)
CVE-2015-2466 Vulnerability in Microsoft Office (CVE-2015-2466)
CVE-2015-2177 Vulnerability in Siemens Simatic S7 300 Cpu Firmware (CVE-2015-2177)
CVE-2004-2771 Vulnerability in Oracle Redhat (CVE-2004-2771)
CVE-2014-0114 Vulnerability in Apache Struts (CVE-2014-0114)
CVE-2014-2653 Vulnerability in OpenBSD Openssh (CVE-2014-2653)
CVE-2014-2532 Vulnerability in Oracle Communications User Data Repository (CVE-2014-2532)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details