Weaknesses of type CWE-20

5,456 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-53030HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2024-53031HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2024-53022HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2025-20056MEDIUMImproper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of prEPSS 0.1%CVE-2025-43365LOWA denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadEPSS 0.1%CVE-2025-25216LOWImproper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow EPSS 0.1%CVE-2024-23362HIGHImproper Input Validation in Trusted Execution EnvironmentEPSS 0.1%CVE-2023-28578CRITICALImproper Input Validation in ServicesEPSS 0.1%CVE-2026-10566MEDIUMFoundationAgents MetaGPT schema.py Message.check_instruct_content deserializationEPSS 0.1%CVE-2025-22453HIGHImproper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allEPSS 0.1%CVE-2023-21627MEDIUMIncorrect Type Conversion or Cast in Trusted Execution EnvironmentEPSS 0.1%CVE-2021-30299MEDIUMImproper Input Validation in AudioEPSS 0.1%CVE-2025-25210HIGHImproper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allEPSS 0.1%CVE-2026-13942LOWInappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoEPSS 0.1%CVE-2022-22264HIGHImproper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary filEPSS 0.1%CVE-2025-25212LOWpasteboard has an improper input vulnerabilityEPSS 0.1%CVE-2026-19543MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.1%CVE-2021-25517HIGHAn improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution.EPSS 0.1%CVE-2021-25339MEDIUMImproper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernelEPSS 0.1%CVE-2024-33065HIGHImproper Input Validation in CameraEPSS 0.1%