Weaknesses of type CWE-20

5,399 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2023-37415HIGHApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userEPSS 1.6%CVE-2026-25892HIGHAdminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version EndpointEPSS 1.6%CVE-2018-0394—A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain resEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2024-34693MEDIUMApache Superset: Server arbitrary file readEPSS 1.6%CVE-2022-24952—Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalidEPSS 1.6%CVE-2017-12244—A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote aEPSS 1.6%CVE-2021-28585MEDIUMMagento Commerce improper input validation in customer customer webapiEPSS 1.6%CVE-2020-7841HIGHTOBESOFT XPLATFORM arbitrary hta file execution vulnerabilityEPSS 1.6%CVE-2019-1689HIGHCisco Webex Teams for iOS Arbitrary File Upload VulnerabilityEPSS 1.6%CVE-2022-39312CRITICALDataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityEPSS 1.6%CVE-2022-47190CRITICALRCE via file upload vulnerability in Generex CS141EPSS 1.6%CVE-2019-1984MEDIUMCisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write VulnerabilityEPSS 1.6%CVE-2021-42854CRITICALDirectory Traversal Read/Write/Delete at PluginServletEPSS 1.6%CVE-2021-42853CRITICALDirectory Traversal Delete/Read at AgentDiagnosticServletEPSS 1.6%CVE-2018-19008—The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor whEPSS 1.6%CVE-2020-5238MEDIUMDenial of service in table parsing in cmark-gfmEPSS 1.6%CVE-2022-39281MEDIUMRemote Denial of Service via Tasks endpoint in fat_free_crmEPSS 1.6%CVE-2020-3441MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityEPSS 1.6%CVE-2024-37373HIGHImproper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achEPSS 1.6%