Weaknesses of type CWE-20

5,847 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2024-46946CRITICALlangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through syEPSS 1.4%CVE-2017-2653MEDIUMA number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesEPSS 1.4%CVE-2019-1905MEDIUMCisco Email Security Appliance GZIP Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2022-25751—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.4%CVE-2024-34109HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 1.4%CVE-2024-45169CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.4%CVE-2026-93952CRITICALSecurity Advisory 0183EPSS 1.4%KEVCVE-2018-7531—An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidaEPSS 1.4%CVE-2021-41138MEDIUMValidity check for signed Frontier-specific extrinsic not called in block executionEPSS 1.4%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.4%CVE-2020-3133MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2024-7014HIGHImproper multimedia file attachment validation in Telegram for Android appEPSS 1.4%CVE-2020-3526HIGHCisco IOS XE Software Common Open Policy Service Engine Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3492HIGHCisco IOS XE Software for Catalyst 9800 Series and Cisco AireOS Software for Cisco WLC Flexible NetFlow Version 9 Denial of Service VulnerabilityEPSS 1.4%CVE-2022-3001HIGHVulnerability in Milesight Video Management Systems (VMS)EPSS 1.4%CVE-2019-15261HIGHCisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service VulnerabilityEPSS 1.4%CVE-2018-0438—Cisco Umbrella Enterprise Roaming Client Privilege Escalation VulnerabilityEPSS 1.4%CVE-2020-3527HIGHCisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3475MEDIUMCisco IOS XE Software Web Management Framework VulnerabilitiesEPSS 1.4%CVE-2019-15289HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilitiesEPSS 1.4%