Weaknesses of type CWE-20

5,842 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.9%CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-47175HIGHlibppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD bufferEPSS 63.6%CVE-2020-3251CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 61.5%CVE-2020-3250CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 60.9%CVE-2020-3495CRITICALCisco Jabber for Windows Message Handling Arbitrary Code Execution VulnerabilityEPSS 60.5%CVE-2024-48914CRITICALVendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS 60.4%CVE-2023-5044HIGHCode injection via nginx.ingress.kubernetes.io/permanent-redirect annotationEPSS 59.6%CVE-2023-39456HIGHApache Traffic Server: Malformed http/2 frames can cause an abortEPSS 58.3%CVE-2021-34427—In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curreEPSS 58.0%CVE-2019-1068HIGHA remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'MicrEPSS 57.3%KEVCVE-2019-11708CRITICALInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeEPSS 55.9%KEVCVE-2022-29499CRITICALThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.EPSS 55.2%KEVCVE-2018-0125CRITICALA vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unautEPSS 55.2%KEVCVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.6%CVE-2023-3710CRITICALPrinter web page invalid command executionEPSS 49.0%CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.4%CVE-2024-45802HIGHSquid Denial of ServiceEPSS 47.9%CVE-2022-46768MEDIUMFile name information disclosure vulnerability in Zabbix Web Service Report GenerationEPSS 47.8%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 47.3%