Cwe 20

🧬 CWE Liées 2,856

slug: cwe-20

Explication

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。

📌 Exemple

多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。

🔗 Liens utiles

MITRE CWE-20 公式ページ ↗

🔖 Étiquettes liées

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnérabilités associées 2,857

ID	Titre	Gravité	Détecté
CVE-2026-101131	A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the…	Low	il y a 2 semaines
CVE-2026-54710	Vulnérabilité dans Sangoma Freepbx (CVE-2026-54710)	High	il y a 2 semaines
CVE-2026-12342	This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the…	Critical	il y a 2 semaines
CVE-2026-101079	A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function…	Low	il y a 2 semaines
CVE-2026-12268	ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT…	High	il y a 2 semaines
CVE-2026-12267	ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy…	High	il y a 2 semaines
CVE-2026-101015	A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown…	High	il y a 2 semaines
CVE-2026-100902	A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some…	Medium	il y a 2 semaines
CVE-2026-88774	Vulnérabilité dans Citrix Netscaler Application Delivery Controller (CVE-2026-88774)	High	il y a 2 semaines
CVE-2026-101041	The account recovery (password reset) functionality in the vulnerability-lookup web application contains a…		il y a 2 semaines
CVE-2026-100833	Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...	Critical	il y a 2 semaines
CVE-2026-88771 KEV	[KEV] Vulnérabilité dans Citrix ADC (CVE-2026-88771)	Critical	il y a 2 semaines
CVE-2026-100699	Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser…	Medium	il y a 3 semaines
CVE-2026-100663	Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…	High	il y a 3 semaines
CVE-2026-100664	Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3…	High	il y a 3 semaines
CVE-2026-100647	vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter...	Medium	il y a 3 semaines
CVE-2026-100652	vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in...	Medium	il y a 3 semaines
CVE-2026-63206	Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which…		il y a 3 semaines
CVE-2026-84462	Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects…		il y a 3 semaines
CVE-2026-56732	Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML…		il y a 3 semaines
CVE-2026-94445	A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's…	High	il y a 3 semaines
CVE-2026-67234	RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used…		il y a 3 semaines
CVE-2026-97869	A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the…	Medium	il y a 3 semaines
CVE-2026-97865	A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of…	High	il y a 3 semaines
CVE-2026-85750	Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when…	High	il y a 3 semaines
CVE-2026-100187	The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as…		il y a 3 semaines
CVE-2026-100177	The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a…		il y a 3 semaines
CVE-2026-91134	Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse…	Medium	il y a 3 semaines
CVE-2025-32000	HCL Sametime is vulnerable to insufficient input sanitization. The application did not...	Medium	il y a 3 semaines
CVE-2026-51997	An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open()…	High	il y a 3 semaines