Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2019-1968MEDIUMCisco NX-OS Software NX-API Denial of Service VulnerabilityEPSS 1.8%CVE-2020-3309MEDIUMCisco Firepower Device Manager On-Box Software Arbitrary File Overwrite VulnerabilityEPSS 1.8%CVE-2025-47171MEDIUMMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 1.8%CVE-2026-54402CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS tEPSS 1.8%CVE-2020-27125HIGHCisco Security Manager Static Credential VulnerabilityEPSS 1.8%CVE-2020-3471MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure VulnerabilityEPSS 1.8%CVE-2024-30054MEDIUMMicrosoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityEPSS 1.7%CVE-2020-3302MEDIUMCisco Firepower Management Center File Overwrite VulnerabilityEPSS 1.7%CVE-2022-46372HIGHAlotcer - AR7088H-A Authenticated Command executionEPSS 1.7%CVE-2019-15288HIGHCisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation VulnerabilityEPSS 1.7%CVE-2018-12479MEDIUMRequest controller allows to create requests with arbitrary request IDsEPSS 1.7%CVE-2020-3170MEDIUMCisco NX-OS Software NX-API Denial of Service VulnerabilityEPSS 1.7%CVE-2018-15449MEDIUMCisco Video Surveillance Media Server Denial of Service VulnerabilityEPSS 1.7%CVE-2024-3646HIGHCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleEPSS 1.7%CVE-2018-0117—A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software cEPSS 1.7%CVE-2020-3496MEDIUMCisco Small Business Smart and Managed Switches Denial of Service VulnerabilityEPSS 1.7%CVE-2023-21816HIGHWindows Active Directory Domain Services API Denial of Service VulnerabilityEPSS 1.7%CVE-2017-12215—A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance could allow an unautEPSS 1.7%CVE-2017-9022HIGHThe gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers EPSS 1.7%CVE-2023-36407HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 1.7%