Weaknesses of type CWE-20

5,845 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2018-0239—A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASEPSS 3.4%CVE-2025-24513MEDIUMingress-nginx controller - auth secret file path traversal vulnerabilityEPSS 3.3%CVE-2026-5174HIGHImproper Access Control Vulnerability in Progress MOVEit AutomationEPSS 3.3%CVE-2009-2055MEDIUMCisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalEPSS 3.3%KEVCVE-2020-25643—A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by iEPSS 3.3%CVE-2022-26782CRITICALMultiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.EPSS 3.3%CVE-2022-26780CRITICALMultiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.EPSS 3.3%CVE-2022-20698HIGHClam AntiVirus (ClamAV) Denial of Service VulnerabilityEPSS 3.3%CVE-2019-15958HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilityEPSS 3.3%CVE-2019-9503HIGHBroadcom brcmfmac driver is vulnerable to a frame validation bypassEPSS 3.3%CVE-2023-40743CRITICALApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceEPSS 3.3%CVE-2019-15957HIGHCisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection VulnerabilityEPSS 3.2%CVE-2018-10920HIGHImproper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.EPSS 3.2%CVE-2018-11615—This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required toEPSS 3.2%CVE-2018-0325—A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP PhoneEPSS 3.2%CVE-2018-0280—A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, rEPSS 3.2%CVE-2018-10903HIGHA flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. IEPSS 3.2%CVE-2018-19016—Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB VerEPSS 3.2%CVE-2021-20611HIGHImproper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, EPSS 3.2%