Weaknesses of type CWE-20

5,393 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-29968MEDIUMActive Directory Certificate Services (AD CS) Denial of Service VulnerabilityEPSS 1.9%CVE-2020-3191HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPv6 DNS Denial of Service VulnerabilityEPSS 1.9%CVE-2019-1983HIGHCisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service VulnerabilityEPSS 1.9%CVE-2018-15409—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 1.9%CVE-2022-47391HIGHCODESYS: Multiple products prone to Improper Input ValidationEPSS 1.9%CVE-2021-45116HIGHAn issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template LanguageEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%CVE-2018-10888—A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound EPSS 1.8%CVE-2020-2011HIGHPAN-OS: Panorama registration denial of serviceEPSS 1.8%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2019-1788HIGHClamAV OLE2 File Out-Of-Bounds Write VulnerabilityEPSS 1.8%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2023-36706MEDIUMWindows Deployment Services Information Disclosure VulnerabilityEPSS 1.8%CVE-2019-12669MEDIUMCisco IOS and IOS XE Software Change of Authorization Denial of Service VulnerabilityEPSS 1.8%CVE-2021-3572—A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue tEPSS 1.8%CVE-2023-25692HIGHApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceEPSS 1.8%CVE-2020-3398HIGHCisco NX-OS Software Border Gateway Protocol Multicast VPN Session Denial of Service VulnerabilityEPSS 1.8%CVE-2019-12656HIGHCisco IOx Application Environment Denial of Service VulnerabilityEPSS 1.8%CVE-2021-21321CRITICALPrefix escapeEPSS 1.8%CVE-2019-1676MEDIUMCisco Meeting Server SIP Processing Denial of Service VulnerabilityEPSS 1.8%