Weaknesses of type CWE-20

5,386 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-34116HIGHIPFire < 2.19 Core Update 101 proxy.cgi RCEEPSS 1.7%CVE-2021-25434—Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using EPSS 1.7%CVE-2021-25435—Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using EPSS 1.7%CVE-2023-7163CRITICALD-Link D-View 8 Unauthenticated Probe-Core Server CommunicationEPSS 1.7%CVE-2024-43455HIGHWindows Remote Desktop Licensing Service Spoofing VulnerabilityEPSS 1.7%CVE-2018-10923HIGHIt was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated aEPSS 1.7%CVE-2020-3230HIGHCisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service VulnerabilityEPSS 1.7%CVE-2018-19005—Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing EPSS 1.7%CVE-2020-3516MEDIUMCisco IOS XE Software Web UI Improper Input Validation VulnerabilityEPSS 1.7%CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2024-49057HIGHMicrosoft Defender for Endpoint on Android Spoofing VulnerabilityEPSS 1.7%CVE-2017-6021—In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, EPSS 1.7%CVE-2019-1720MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.7%CVE-2024-55020CRITICALA command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attEPSS 1.7%CVE-2020-27833—A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafEPSS 1.7%CVE-2022-36087MEDIUMOAuthLib vulnerable DoS when attacker provides malicious IPV6 URIEPSS 1.7%CVE-2025-47171MEDIUMMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 1.7%CVE-2023-27604HIGHApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%