Weaknesses of type CWE-20

5,393 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2020-17532—Apache ServiceComb Yaml remote deserialization vulnerabilityEPSS 3.2%CVE-2026-5174HIGHImproper Access Control Vulnerability in Progress MOVEit AutomationEPSS 3.2%CVE-2018-10920HIGHImproper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.EPSS 3.2%CVE-2020-0041HIGHIn binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalaEPSS 3.2%KEVCVE-2018-10903HIGHA flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. IEPSS 3.2%CVE-2018-19016—Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB VerEPSS 3.2%CVE-2018-0456HIGHCisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 3.2%CVE-2017-7466HIGHAnsible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control EPSS 3.1%CVE-2023-36767MEDIUMMicrosoft Office Security Feature Bypass VulnerabilityEPSS 3.1%CVE-2019-15961HIGHClam AntiVirus (ClamAV) Software Email Parsing VulnerabilityEPSS 3.1%CVE-2017-3858—A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands thaEPSS 3.1%CVE-2019-12689HIGHCisco Firepower Management Center Remote Code Execution VulnerabilityEPSS 3.1%CVE-2019-1716HIGHCisco IP Phone 7800 Series and 8800 Series Remote Code Execution VulnerabilityEPSS 3.1%CVE-2018-0387—A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on thEPSS 3.1%CVE-2018-1139MEDIUMA flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabEPSS 3.1%CVE-2023-3955HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 3.1%CVE-2024-20666MEDIUMBitLocker Security Feature Bypass VulnerabilityEPSS 3.1%CVE-2020-3111HIGHCisco IP Phone Remote Code Execution and Denial of Service VulnerabilityEPSS 3.1%CVE-2018-0264—A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteEPSS 3.1%CVE-2020-10738HIGHA flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versionEPSS 3.1%