Cwe 20

🧬 CWE Liées 2,856

slug: cwe-20

Explication

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。

📌 Exemple

多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。

🔗 Liens utiles

MITRE CWE-20 公式ページ ↗

🔖 Étiquettes liées

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnérabilités associées 2,857

ID	Titre	Gravité	Détecté
CVE-2026-77797	Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain…	Low	il y a 3 semaines
CVE-2026-17503	Vulnérabilité dans Ibm Power System S1122S 9824 22B Firmware (CVE-2026-17503)	Medium	il y a 3 semaines
CVE-2026-97182	A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the…	High	il y a 3 semaines
CVE-2026-82407	Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20…		il y a 3 semaines
CVE-2026-95843	Vulnérabilité dans Moquette (CVE-2026-95843)	High	il y a 3 semaines
CVE-2026-62998	REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in…	Medium	il y a 3 semaines
CVE-2026-86679	ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue…	High	il y a 3 semaines
CVE-2026-86683	ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy…	High	il y a 3 semaines
CVE-2026-76980	ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure…	High	il y a 3 semaines
CVE-2026-87071	Vulnérabilité dans WordPress (CVE-2026-87071)	Medium	il y a 3 semaines
CVE-2026-95928	A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function…	Medium	il y a 3 semaines
CVE-2026-95897	A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file…	Medium	il y a 3 semaines
CVE-2026-76711	Vulnérabilité dans Arubanetworks (CVE-2026-76711)	High	il y a 3 semaines
CVE-2026-63627	mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in…		il y a 3 semaines
CVE-2026-63628	mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in…		il y a 3 semaines
CVE-2026-81995	Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in…	Critical	il y a 3 semaines
CVE-2026-76194	Vulnérabilité dans Adobe C2Pa (CVE-2026-76194)	Medium	il y a 3 semaines
CVE-2026-75686	Vulnérabilité dans Adobe macOS (CVE-2026-75686)	Critical	il y a 3 semaines
CVE-2026-75638	Vulnérabilité dans Adobe C2Pa (CVE-2026-75638)	Medium	il y a 3 semaines
CVE-2026-75634	Vulnérabilité dans Adobe C2Pa (CVE-2026-75634)	Medium	il y a 3 semaines
CVE-2026-75633	Vulnérabilité dans Adobe C2Pa (CVE-2026-75633)	Medium	il y a 3 semaines
CVE-2026-19480	Vulnérabilité dans Adobe C2Pa (CVE-2026-19480)	High	il y a 3 semaines
CVE-2026-82008	Vulnérabilité dans Adobe Windows (CVE-2026-82008)	Critical	il y a 3 semaines
CVE-2026-82003	Vulnérabilité dans Adobe Windows (CVE-2026-82003)	High	il y a 3 semaines
CVE-2026-77605	Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in…	High	il y a 3 semaines
CVE-2026-95703	In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem…		il y a 3 semaines
CVE-2026-95679	MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying…		il y a 3 semaines
CVE-2026-95674	In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list…		il y a 3 semaines
CVE-2026-95659	MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action…		il y a 3 semaines
CVE-2026-93952 KEV	[KEV] Vulnérabilité dans Arista (CVE-2026-93952)	Critical	il y a 3 semaines