Weaknesses of type CWE-20

5,833 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-36044HIGHMagento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceEPSS 2.0%CVE-2021-36021HIGHMagento Commerce CMS Page Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.0%CVE-2018-0299—A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow anEPSS 2.0%CVE-2021-37909CRITICALCHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input ValidationEPSS 2.0%CVE-2018-0291—A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticatedEPSS 2.0%CVE-2023-30631—Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workEPSS 2.0%CVE-2022-47185HIGHApache Traffic Server: Invalid Range header causes a crashEPSS 2.0%CVE-2021-40120MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilityEPSS 2.0%CVE-2018-0248MEDIUMCisco Wireless LAN Controller Software GUI Configuration Denial of Service VulnerabilitiesEPSS 2.0%CVE-2019-10190MEDIUMA vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers tEPSS 2.0%CVE-2021-44040—HTTP request line fuzzing attacksEPSS 2.0%CVE-2011-10008HIGHMPlayer Lite r33064 M3U Stack-Based Buffer OverflowEPSS 2.0%CVE-2014-2653MEDIUMThe verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFPEPSS 2.0%CVE-2023-38156HIGHAzure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityEPSS 2.0%CVE-2019-1964HIGHCisco NX-OS Software IPv6 Denial of Service VulnerabilityEPSS 2.0%CVE-2014-125119HIGHWinRAR < 5.00 Filename Spoofing RCEEPSS 2.0%CVE-2019-12653HIGHCisco IOS XE Software Raw Socket Transport Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1962HIGHCisco NX-OS Software Cisco Fabric Services over IP Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12657HIGHCisco IOS XE Software Unified Threat Defense Denial of Service VulnerabilityEPSS 2.0%CVE-2023-25696CRITICALApache Airflow Hive Provider Beeline RCEEPSS 2.0%