Weaknesses of type CWE-20

5,455 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2026-82738MEDIUMAsh.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of serviceEPSS 0.2%CVE-2024-33611MEDIUMImproper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to poEPSS 0.2%CVE-2024-52051HIGHA vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17EPSS 0.2%CVE-2023-25175MEDIUMImproper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information dEPSS 0.2%CVE-2021-37674MEDIUMIncomplete validation in `MaxPoolGrad` in TensorFlowEPSS 0.2%CVE-2023-21498MEDIUMImproper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to oEPSS 0.2%CVE-2024-21863MEDIUMDsoftbus has an improper input validation vulnerabilityEPSS 0.2%CVE-2023-33014HIGHImproper Input Validation in ServicesEPSS 0.2%CVE-2022-31616MEDIUMNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a loEPSS 0.2%CVE-2026-11701MEDIUMInappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a cEPSS 0.2%CVE-2026-17774HIGHInsufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged networkEPSS 0.2%CVE-2022-43449MEDIUMArbitrary file read via download_server.EPSS 0.2%CVE-2025-24882MEDIUMregclient may ignore pinned manifest digestsEPSS 0.2%CVE-2025-58146CRITICALXAPI UTF-8 string handlingEPSS 0.2%CVE-2022-37010LOWIn JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missedEPSS 0.2%CVE-2026-11685MEDIUMInappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin EPSS 0.2%CVE-2023-45176MEDIUMIBM App Connect Enterprise and IBM Integration Bus denial of serviceEPSS 0.2%CVE-2022-37336HIGHImproper input validation in BIOS firmware for some Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege vEPSS 0.2%CVE-2021-25413—Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to acEPSS 0.2%CVE-2022-3675LOWFedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to aEPSS 0.2%