Weaknesses of type CWE-20

5,397 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-21060MEDIUMAcrobat Pro DC Improper File Parsing Could Lead to Information DisclosureEPSS 1.6%CVE-2018-10885MEDIUMIn atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-netwoEPSS 1.6%CVE-2022-3294MEDIUMNode address isn't always verified when proxyingEPSS 1.6%CVE-2024-2469HIGHRemote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceEPSS 1.6%CVE-2021-1304HIGHCisco SD-WAN vManage Authorization Bypass VulnerabilitiesEPSS 1.6%CVE-2021-3524—A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the iEPSS 1.6%CVE-2020-27824—A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafteEPSS 1.6%CVE-2020-7821HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2023-34102HIGHPossible unsafe reflection / partial denial of service in avoEPSS 1.6%CVE-2020-7820HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2022-43439CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0EPSS 1.6%CVE-2021-21357HIGHBroken Access Control in Form FrameworkEPSS 1.6%CVE-2017-12300—A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aEPSS 1.6%CVE-2019-7589CRITICALKantech EntraPass Improper Input ValidationEPSS 1.6%CVE-2021-1431HIGHCisco IOS XE SD-WAN Software vDaemon Denial of Service VulnerabilityEPSS 1.6%CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2023-25691CRITICALApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2019-19279—A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versioEPSS 1.6%CVE-2018-15425—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.6%