Cwe 20

🧬 CWE Liées 2,856

slug: cwe-20

Explication

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。

📌 Exemple

多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。

🔗 Liens utiles

MITRE CWE-20 公式ページ ↗

🔖 Étiquettes liées

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnérabilités associées 2,857

ID	Titre	Gravité	Détecté
CVE-2026-49453	Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to…	High	il y a 3 semaines
CVE-2026-73547	Vulnérabilité dans Envoyproxy (CVE-2026-73547)	High	il y a 3 semaines
CVE-2026-73552	Vulnérabilité dans Envoyproxy (CVE-2026-73552)	High	il y a 3 semaines
CVE-2026-73513	Vulnérabilité dans Envoyproxy (CVE-2026-73513)	High	il y a 3 semaines
CVE-2026-94383	The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file…		il y a 3 semaines
CVE-2026-94379	The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several…		il y a 3 semaines
CVE-2026-94092	A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file…	Medium	il y a 3 semaines
CVE-2026-94093	A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function…	Medium	il y a 3 semaines
CVE-2026-94091	A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file…	Medium	il y a 3 semaines
CVE-2026-92254	Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640…		il y a 3 semaines
CVE-2026-81180	SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor…	High	il y a 4 semaines
CVE-2026-61794	Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update…	Medium	il y a 4 semaines
CVE-2026-93567	HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled ...	High	il y a 4 semaines
CVE-2026-93568	A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or…	High	il y a 4 semaines
CVE-2026-25684	A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper…	Medium	il y a 4 semaines
CVE-2026-12954	Vulnérabilité dans WordPress (CVE-2026-12954)	High	il y a 4 semaines
CVE-2026-18911	ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing…	High	il y a 4 semaines
CVE-2026-54501	Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used…		il y a 4 semaines
CVE-2026-93295	MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web…		il y a 4 semaines
CVE-2026-54577	mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted…		il y a 4 semaines
CVE-2026-61793	Vulnérabilité dans nuxt-og-image (CVE-2026-61793)		il y a 1 mois
CVE-2026-92860	A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this...	Critical	il y a 1 mois
CVE-2026-92581	In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values...	Medium	il y a 1 mois
CVE-2026-20237	As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco...	Critical	il y a 1 mois
CVE-2026-81875	HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to…	High	il y a 1 mois
CVE-2026-81876	HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to…	High	il y a 1 mois
CVE-2026-90999	Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled…	Critical	il y a 1 mois
CVE-2026-88064	Vulnérabilité dans Linuxfoundation (CVE-2026-88064)	High	il y a 1 mois
CVE-2026-77190	On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to...	Medium	il y a 1 mois
CVE-2026-73445	On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI...	Medium	il y a 1 mois