Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-2469HIGHRemote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2020-7821HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2020-7820HIGHTobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityEPSS 1.6%CVE-2023-34102HIGHPossible unsafe reflection / partial denial of service in avoEPSS 1.6%CVE-2021-21357HIGHBroken Access Control in Form FrameworkEPSS 1.6%CVE-2017-12300—A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aEPSS 1.6%CVE-2021-3524—A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the iEPSS 1.6%CVE-2019-7589CRITICALKantech EntraPass Improper Input ValidationEPSS 1.6%CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2023-25691CRITICALApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2019-19279—A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versioEPSS 1.6%CVE-2022-36125HIGHInteger overflow when reading corrupted .avro file in Avro Rust SDKEPSS 1.6%CVE-2018-15425—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.6%CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2023-37415HIGHApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userEPSS 1.6%CVE-2018-0394—A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain resEPSS 1.6%CVE-2024-34693MEDIUMApache Superset: Server arbitrary file readEPSS 1.6%CVE-2026-26106HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.6%