Weaknesses of type CWE-20

5,393 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2019-18228—Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HEPSS 2.1%CVE-2021-1275CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.1%CVE-2018-15369—Cisco IOS and IOS XE Software TACACS+ Client Denial of Service VulnerabilityEPSS 2.1%CVE-2023-28707HIGHAirflow Apache Drill Provider Arbitrary File Read VulnerabilityEPSS 2.1%CVE-2025-34118HIGHLinknat VOS Manager Path Traversal File DisclosureEPSS 2.1%CVE-2022-42837CRITICALAn issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOSEPSS 2.1%CVE-2020-7069MEDIUMWrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVEPSS 2.1%CVE-2024-6436HIGHRockwell Automation Input Validation Vulnerability exists in the SequenceManager™ ServerEPSS 2.1%CVE-2021-37533MEDIUMApache Commons Net's FTP client trusts the host from PASV response by defaultEPSS 2.1%CVE-2020-28221—A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the EPSS 2.1%CVE-2019-1806HIGHCisco Small Business Series Switches Simple Network Management Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2023-32015CRITICALWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2022-31778—Transfer-Encoding not treated as hop-by-hopEPSS 2.0%CVE-2026-2113MEDIUMyuan1994 tpadmin WebUploader preview.php deserializationEPSS 2.0%CVE-2019-1721HIGHCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1697MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Lightweight Directory Access Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2014-0761—CG Automation ePAQ-9410 Substation Gateway Improper Input ValidationEPSS 2.0%CVE-2018-7511—In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in EPSS 2.0%CVE-2021-1468CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.0%CVE-2023-36821HIGHUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationEPSS 2.0%