Weaknesses of type CWE-20

5,840 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2019-12657HIGHCisco IOS XE Software Unified Threat Defense Denial of Service VulnerabilityEPSS 2.0%CVE-2023-25696CRITICALApache Airflow Hive Provider Beeline RCEEPSS 2.0%CVE-2021-29486HIGHImproper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionEPSS 2.0%CVE-2021-45116HIGHAn issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template LanguageEPSS 2.0%CVE-2020-10289HIGHRVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132EPSS 2.0%CVE-2018-0298—A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to caEPSS 2.0%CVE-2019-12655HIGHCisco IOS XE Software FTP Application Layer Gateway for NAT, NAT64, and ZBFW Denial of Service VulnerabilityEPSS 2.0%CVE-2018-10930MEDIUMA flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destiEPSS 2.0%CVE-2021-21404HIGHCrash due to malformed relay protocol messageEPSS 2.0%CVE-2020-36332—A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threaEPSS 2.0%CVE-2017-3846—A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticateEPSS 2.0%CVE-2020-9743MEDIUMHTML injection in AEM's content editor componentEPSS 2.0%CVE-2018-15428—Cisco IOS XR Software Border Gateway Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2021-20273—A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.EPSS 2.0%CVE-2021-23192—A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragmenEPSS 2.0%CVE-2020-8187—Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform EPSS 1.9%CVE-2025-34116HIGHIPFire < 2.19 Core Update 101 proxy.cgi RCEEPSS 1.9%CVE-2026-5946HIGHInvalid handling of CLASS != INEPSS 1.9%CVE-2022-24723MEDIUMImproper Input Validation in URI.jsEPSS 1.9%CVE-2019-13541—In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processiEPSS 1.9%