Weaknesses of type CWE-20

5,891 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-45537MEDIUMApache Druid: Users can provide MySQL JDBC properties not on allow listEPSS 0.6%CVE-2023-37555MEDIUMCODESYS Improper Input Validation in CmpAppBPEPSS 0.6%CVE-2023-37558MEDIUMCODESYS Improper Validation of Consistency within Input in multiple productsEPSS 0.6%CVE-2023-37548MEDIUMCODESYS: Improper Input Validation in CmpApp componentEPSS 0.6%CVE-2026-24412HIGHiccDEV has Heap Buffer Overflow in icCurvesFromXml()EPSS 0.6%CVE-2023-37545MEDIUMCODESYS: Improper Input Validation in CmpApp componentEPSS 0.6%CVE-2023-31203MEDIUMImproper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow EPSS 0.6%CVE-2026-55994HIGHApache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviourEPSS 0.6%CVE-2019-19095MEDIUMABB eSOMS: Stored XSS vulnerabilityEPSS 0.6%CVE-2022-32253MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL cerEPSS 0.6%CVE-2023-52296MEDIUMIBM Db2 for Linux, UNIX and Windows denial of serviceEPSS 0.6%CVE-2026-46592HIGHApache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operationEPSS 0.6%CVE-2023-47106MEDIUMIncorrect processing of fragment in the URL leads to Authorization Bypass in TraefikEPSS 0.6%CVE-2026-22868HIGHgo-ethereum has a DoS via malicious p2p messageEPSS 0.6%CVE-2018-0197—Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service VulnerabilityEPSS 0.6%CVE-2023-21504MEDIUMPotential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackersEPSS 0.6%CVE-2025-27489HIGHAzure Local Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2021-1482MEDIUMCisco SD-WAN vManage Authorization Bypass VulnerabilityEPSS 0.6%CVE-2023-21503MEDIUMPotential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attaEPSS 0.6%CVE-2022-23766HIGHBigFileAgent arbitrary file execution vulnerabilityEPSS 0.6%