Weaknesses of type CWE-20

5,811 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2020-7069MEDIUMWrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVEPSS 2.1%CVE-2024-6436HIGHRockwell Automation Input Validation Vulnerability exists in the SequenceManager™ ServerEPSS 2.1%CVE-2019-1697MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Lightweight Directory Access Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1806HIGHCisco Small Business Series Switches Simple Network Management Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2023-32015CRITICALWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-36706MEDIUMWindows Deployment Services Information Disclosure VulnerabilityEPSS 2.0%CVE-2019-1721HIGHCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 2.0%CVE-2014-0761—CG Automation ePAQ-9410 Substation Gateway Improper Input ValidationEPSS 2.0%CVE-2025-29968MEDIUMActive Directory Certificate Services (AD CS) Denial of Service VulnerabilityEPSS 2.0%CVE-2018-7511—In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in EPSS 2.0%CVE-2021-1468CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.0%CVE-2023-36821HIGHUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationEPSS 2.0%CVE-2020-1695HIGHA flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an impropeEPSS 2.0%CVE-2018-15410—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15411—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15418—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15419—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15421—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15422—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2019-11255MEDIUMKubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutationEPSS 2.0%