Weaknesses of type CWE-20

5,399 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2025-59228HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 1.4%CVE-2020-3527HIGHCisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service VulnerabilityEPSS 1.4%CVE-2019-15261HIGHCisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service VulnerabilityEPSS 1.4%CVE-2022-1727HIGHImproper Input Validation in jgraph/drawioEPSS 1.4%CVE-2024-9042MEDIUMThis CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listeEPSS 1.4%CVE-2023-30449HIGHIBM Db2 denial of serviceEPSS 1.4%CVE-2018-16561HIGHA vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication EPSS 1.4%CVE-2023-30445HIGHIBM Db2 denial of serviceEPSS 1.4%CVE-2024-31862MEDIUMApache Zeppelin: Denial of service with invalid notebook nameEPSS 1.4%CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-7014HIGHImproper multimedia file attachment validation in Telegram for Android appEPSS 1.4%CVE-2018-12474MEDIUMCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmEPSS 1.4%CVE-2018-10843HIGHsource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to EPSS 1.4%CVE-2024-26189HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.4%CVE-2019-1905MEDIUMCisco Email Security Appliance GZIP Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2020-7849HIGHUPRISM CURIX arbitrary code execution vulnerabilityEPSS 1.4%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.4%CVE-2019-1678MEDIUMCisco Meeting Server Denial of Service VulnerabilityEPSS 1.4%CVE-2023-30448MEDIUMIBM Db2 denial of serviceEPSS 1.4%CVE-2025-12543CRITICALUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfEPSS 1.4%