Weaknesses of type CWE-20

5,385 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-47175HIGHlibppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD bufferEPSS 63.6%CVE-2020-3251CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 61.5%CVE-2020-3250CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 60.9%CVE-2024-48914CRITICALVendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS 60.4%CVE-2020-3495CRITICALCisco Jabber for Windows Message Handling Arbitrary Code Execution VulnerabilityEPSS 59.9%CVE-2021-34427—In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curreEPSS 58.0%CVE-2023-5044HIGHCode injection via nginx.ingress.kubernetes.io/permanent-redirect annotationEPSS 56.6%CVE-2019-11708CRITICALInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeEPSS 55.9%KEVCVE-2022-29499CRITICALThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.EPSS 55.6%KEVCVE-2018-0125CRITICALA vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unautEPSS 55.2%KEVCVE-2023-39456HIGHApache Traffic Server: Malformed http/2 frames can cause an abortEPSS 53.8%CVE-2019-1068HIGHA remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'MicrEPSS 52.8%KEVCVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.3%CVE-2023-3710CRITICALPrinter web page invalid command executionEPSS 49.0%CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.7%CVE-2024-45802HIGHSquid Denial of ServiceEPSS 47.9%CVE-2022-46768MEDIUMFile name information disclosure vulnerability in Zabbix Web Service Report GenerationEPSS 47.8%CVE-2023-44355MEDIUMColdFusion | Improper Input Validation (CWE-20)EPSS 47.2%CVE-2023-4357HIGHInsufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access reEPSS 47.1%