Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2024-49057HIGHMicrosoft Defender for Endpoint on Android Spoofing VulnerabilityEPSS 1.7%CVE-2019-1720MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.7%CVE-2020-27833—A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafEPSS 1.7%CVE-2022-4886HIGHIngress-nginx `path` sanitization can be bypassed with `log_format` directiveEPSS 1.7%CVE-2024-43455HIGHWindows Remote Desktop Licensing Service Spoofing VulnerabilityEPSS 1.7%CVE-2020-7880HIGHdouzone NeoRS remote support program ActiveX vulnerabilityEPSS 1.7%CVE-2021-1431HIGHCisco IOS XE SD-WAN Software vDaemon Denial of Service VulnerabilityEPSS 1.7%CVE-2023-27604HIGHApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityEPSS 1.7%CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2017-2617HIGHhawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a craEPSS 1.7%CVE-2026-34980MEDIUMOpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the networkEPSS 1.7%CVE-2020-8124—Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasEPSS 1.7%CVE-2019-1831MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.6%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2025-34099CRITICALVICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth PasswordEPSS 1.6%CVE-2022-24423MEDIUMDell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially explEPSS 1.6%CVE-2025-43559CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 1.6%CVE-2021-28655MEDIUMApache Zeppelin: Arbitrary file deletion vulnerabilityEPSS 1.6%