Weaknesses of type CWE-20

5,845 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2018-0456HIGHCisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 3.2%CVE-2020-0041HIGHIn binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalaEPSS 3.2%KEVCVE-2020-6998MEDIUMRockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input ValidationEPSS 3.2%CVE-2021-41561—Apache Parquet-MR potential DoS in case of malicious Parquet fileEPSS 3.2%CVE-2023-36767MEDIUMMicrosoft Office Security Feature Bypass VulnerabilityEPSS 3.1%CVE-2019-15961HIGHClam AntiVirus (ClamAV) Software Email Parsing VulnerabilityEPSS 3.1%CVE-2017-3858—A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands thaEPSS 3.1%CVE-2019-12689HIGHCisco Firepower Management Center Remote Code Execution VulnerabilityEPSS 3.1%CVE-2019-1716HIGHCisco IP Phone 7800 Series and 8800 Series Remote Code Execution VulnerabilityEPSS 3.1%CVE-2018-0387—A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on thEPSS 3.1%CVE-2018-1139MEDIUMA flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabEPSS 3.1%CVE-2021-1316HIGHCisco Small Business RV Series Routers Management Interface Command Injection VulnerabilitiesEPSS 3.1%CVE-2021-1318HIGHCisco Small Business RV Series Routers Management Interface Command Injection VulnerabilitiesEPSS 3.1%CVE-2021-1317HIGHCisco Small Business RV Series Routers Management Interface Command Injection VulnerabilitiesEPSS 3.1%CVE-2024-20666MEDIUMBitLocker Security Feature Bypass VulnerabilityEPSS 3.1%CVE-2021-1314HIGHCisco Small Business RV Series Routers Management Interface Command Injection VulnerabilitiesEPSS 3.1%CVE-2021-1315HIGHCisco Small Business RV Series Routers Management Interface Command Injection VulnerabilitiesEPSS 3.1%CVE-2025-50578CRITICALLinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` aEPSS 3.1%CVE-2020-3111HIGHCisco IP Phone Remote Code Execution and Denial of Service VulnerabilityEPSS 3.1%CVE-2016-9158HIGHA vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPEPSS 3.1%