Weaknesses of type CWE-20

5,842 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-29371HIGHWindows GDI Elevation of Privilege VulnerabilityEPSS 5.4%CVE-2020-3252CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 5.3%CVE-2025-66959HIGHAn issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoderEPSS 5.3%CVE-2017-12319MEDIUMA vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow aEPSS 5.2%KEVCVE-2021-44548—Apache Solr information disclosure vulnerability through DataImportHandlerEPSS 5.2%CVE-2024-30078HIGHWindows Wi-Fi Driver Remote Code Execution VulnerabilityEPSS 5.2%CVE-2019-16056MEDIUMAn issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly EPSS 5.1%CVE-2011-0627HIGHAdobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to EPSS 5.1%CVE-2020-3327HIGHClamAV ARJ Archive Parsing Denial of Service VulnerabilityEPSS 5.1%CVE-2018-1060MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. AnEPSS 5.0%CVE-2018-16874MEDIUMIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path oEPSS 5.0%CVE-2020-7070MEDIUMPHP parses encoded cookie names so malicious `__Host-` cookies can be sentEPSS 5.0%CVE-2024-7340HIGHW&B Weave server remote arbitrary file leak and privilege escalationEPSS 5.0%CVE-2022-40773HIGHZoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows EPSS 5.0%CVE-2021-38000MEDIUMInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraEPSS 4.9%KEVCVE-2020-3218HIGHCisco IOS XE Software Web UI Remote Code Execution VulnerabilityEPSS 4.9%CVE-2020-6962—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 4.9%CVE-2018-14644MEDIUMAn issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type likEPSS 4.8%CVE-2016-10555—Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent tEPSS 4.8%CVE-2024-7988CRITICALThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesEPSS 4.8%