Weaknesses of type CWE-20

5,390 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-1140CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2021-1138CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2018-15454HIGHCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 4.4%CVE-2019-1861HIGHCisco Industrial Network Director Remote Code Execution VulnerabilityEPSS 4.4%CVE-2021-1142CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.3%CVE-2016-8625MEDIUMcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and EPSS 4.3%CVE-2023-26405HIGHZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions BypassEPSS 4.3%CVE-2023-26407HIGHZDI-CAN-20712: Net.HTTP.request Arbitrary Command ExecutionEPSS 4.3%CVE-2018-10858MEDIUMA heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server couEPSS 4.3%CVE-2023-5528HIGHKubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalationEPSS 4.3%CVE-2017-6616—A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tEPSS 4.2%CVE-2020-3357CRITICALCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service VulnerabilityEPSS 4.2%CVE-2017-14022—An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unautheEPSS 4.2%CVE-2021-3907HIGHArbitrary filepath traversal via URI injectionEPSS 4.2%CVE-2018-13807—A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versEPSS 4.2%CVE-2014-5410—Rockwell Automation Micrologix 1400 Improper Input ValidationEPSS 4.2%CVE-2020-8125—Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code EPSS 4.1%CVE-2020-3263HIGHCisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution VulnerabilityEPSS 4.1%CVE-2017-12652CRITICALlibpng before 1.6.32 does not properly check the length of chunks against the user limit.EPSS 4.1%CVE-2019-14894HIGHA flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code executEPSS 4.1%