Weaknesses of type CWE-20

5,842 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2019-1822HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesEPSS 4.4%CVE-2023-41061HIGHA validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafEPSS 4.4%KEVCVE-2021-1142CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2025-34101CRITICALServiio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO ParameterEPSS 4.4%CVE-2016-9579MEDIUMA flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucEPSS 4.3%CVE-2018-0279—A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticateEPSS 4.3%CVE-2016-8625MEDIUMcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and EPSS 4.3%CVE-2023-26405HIGHZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions BypassEPSS 4.3%CVE-2023-26407HIGHZDI-CAN-20712: Net.HTTP.request Arbitrary Command ExecutionEPSS 4.3%CVE-2017-2669LOWDovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the useEPSS 4.3%CVE-2018-10858MEDIUMA heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server couEPSS 4.3%CVE-2022-35668MEDIUMAdobe Acrobat Reader Improper Input Validation Memory leakEPSS 4.3%CVE-2019-1861HIGHCisco Industrial Network Director Remote Code Execution VulnerabilityEPSS 4.3%CVE-2018-15454HIGHCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 4.3%CVE-2017-6616—A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tEPSS 4.2%CVE-2020-3357CRITICALCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service VulnerabilityEPSS 4.2%CVE-2020-3263HIGHCisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution VulnerabilityEPSS 4.2%CVE-2017-14022—An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unautheEPSS 4.2%CVE-2021-3907HIGHArbitrary filepath traversal via URI injectionEPSS 4.2%CVE-2018-13807—A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versEPSS 4.2%