Weaknesses of type CWE-20

5,393 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2020-8124—Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasEPSS 1.7%CVE-2011-10008HIGHMPlayer Lite r33064 M3U Stack-Based Buffer OverflowEPSS 1.7%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 1.6%CVE-2019-1831MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.6%CVE-2022-24423MEDIUMDell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially explEPSS 1.6%CVE-2021-25436—Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via EPSS 1.6%CVE-2023-38254MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12218—A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeEPSS 1.6%CVE-2021-43762MEDIUMAdobe Experience Manager Unicode normalization leads to dispatcher bypassEPSS 1.6%CVE-2021-1505CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2021-1508CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2026-50748CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.6%CVE-2021-21322CRITICALPrefix escapeEPSS 1.6%CVE-2020-25717—A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilegEPSS 1.6%CVE-2022-43546CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.6%CVE-2020-7869CRITICALAn improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fEPSS 1.6%CVE-2022-20797MEDIUMCisco Secure Network Analytics Remote Code Execution VulnerabilityEPSS 1.6%