Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2017-12244—A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote aEPSS 1.6%CVE-2021-28585MEDIUMMagento Commerce improper input validation in customer customer webapiEPSS 1.6%CVE-2020-7841HIGHTOBESOFT XPLATFORM arbitrary hta file execution vulnerabilityEPSS 1.6%CVE-2019-1689HIGHCisco Webex Teams for iOS Arbitrary File Upload VulnerabilityEPSS 1.6%CVE-2025-34055CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.6%CVE-2025-53809MEDIUMWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.6%CVE-2019-1984MEDIUMCisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write VulnerabilityEPSS 1.6%CVE-2022-47190CRITICALRCE via file upload vulnerability in Generex CS141EPSS 1.6%CVE-2021-42853CRITICALDirectory Traversal Delete/Read at AgentDiagnosticServletEPSS 1.6%CVE-2021-42854CRITICALDirectory Traversal Read/Write/Delete at PluginServletEPSS 1.6%CVE-2018-19008—The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor whEPSS 1.6%CVE-2020-5238MEDIUMDenial of service in table parsing in cmark-gfmEPSS 1.6%CVE-2022-29243MEDIUMImproper input-size validation on the user new session name in Nextcloud ServerEPSS 1.6%CVE-2020-3441MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityEPSS 1.6%CVE-2024-37373HIGHImproper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achEPSS 1.6%CVE-2020-7842MEDIUMD'live AP command injection vulnerabilityEPSS 1.6%CVE-2018-10923HIGHIt was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated aEPSS 1.6%CVE-2020-14513—CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverEPSS 1.6%CVE-2022-24847HIGHImproper Input Validation in GeoServerEPSS 1.6%CVE-2019-12632MEDIUMCisco Finesse Request Processing Server-Side Request Forgery VulnerabilityEPSS 1.6%