Weaknesses of type CWE-20

5,888 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-46929HIGHAn issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:EPSS 0.8%CVE-2024-25131HIGHOpenshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalationEPSS 0.8%CVE-2021-41250MEDIUMPresence of non-blacklisted URL bypasses all other filtersEPSS 0.8%CVE-2021-39230HIGHError in JPNS kernel of ButterEPSS 0.8%CVE-2023-32075MEDIUMPimcore vulnerable to Business Logic Errors in Customer automation rulesEPSS 0.8%CVE-2024-38243HIGHKernel Streaming Service Driver Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-4427MEDIUMSQL Injection via OTRS Search APIEPSS 0.8%CVE-2018-19010—Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. AEPSS 0.8%CVE-2022-29492MEDIUMA vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...EPSS 0.8%CVE-2017-3849—A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and CiEPSS 0.8%CVE-2023-32890MEDIUMIn modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additioEPSS 0.8%CVE-2023-49551HIGHAn issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.EPSS 0.8%CVE-2026-23571MEDIUMCommand Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEXEPSS 0.8%CVE-2024-52802HIGHRIOT-OS missing dhcpv6_opt_t minimum header length checkEPSS 0.8%CVE-2022-4033MEDIUMQuiz and Survey Master <= 8.0.4 - Improper Input ValidationEPSS 0.8%CVE-2022-34851MEDIUMBIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851EPSS 0.8%CVE-2023-48608LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.8%CVE-2023-27496MEDIUMEnvoy may crash when a redirect url without a state param is received in the oauth filterEPSS 0.8%CVE-2021-25444—An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process.EPSS 0.8%CVE-2023-5571MEDIUMImproper Input Validation in vriteio/vriteEPSS 0.8%