Weaknesses of type CWE-20

5,887 results

Validação inadequada de entrada

O software recebe dados do usuário ou de fontes externas, mas não verifica ou verifica de forma incompleta se esses dados têm as propriedades necessárias para processar com segurança. Isso permite que entradas malformadas, maliciosas ou inesperadas passem por controles e causem comportamentos indevidos — desde crashes até injeção de código.

Example

Uma aplicação web recebe um parâmetro numérico via GET, mas não valida se é realmente um número inteiro válido antes de usá-lo em uma consulta SQL. Um atacante envia um valor com caracteres especiais (ex: `1' OR '1'='1`), conseguindo injetar código SQL direto no banco de dados.

How to mitigate

Implemente validação rigorosa na entrada: defina o tipo, formato, comprimento e intervalo esperados; rejeite tudo que não se encaixe. Use listas de caracteres permitidos ('whitelist'), escape de dados para o contexto específico (SQL, HTML, URL) e bibliotecas de validação consolidadas. Nunca confie em dados do cliente.

CVE-2021-22699—Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of EPSS 1.0%CVE-2021-34570HIGHPhoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTSEPSS 1.0%CVE-2021-1220MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 1.0%CVE-2023-42448HIGHHydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadlineEPSS 1.0%CVE-2021-1356MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 1.0%CVE-2021-4219—A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw EPSS 1.0%CVE-2023-45163CRITICAL1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code executionEPSS 1.0%CVE-2023-40372MEDIUMIBM Db2 denial of serviceEPSS 1.0%CVE-2023-40373MEDIUMIBM Db2 denial of serviceEPSS 1.0%CVE-2021-20252—A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateEPSS 1.0%CVE-2024-21374MEDIUMMicrosoft Teams for Android Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-63913HIGHnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction checkEPSS 1.0%CVE-2023-28513MEDIUMIBM MQ denial of serviceEPSS 1.0%CVE-2025-34159CRITICALCoolify Docker Compose Directive Injection in Application Deployment WorkflowEPSS 1.0%CVE-2022-2529HIGHMultiple DoS Attack Vectors in sflow packet handlingEPSS 1.0%CVE-2023-27599HIGHOpenSIPS has vulnerability in the parse_to_param() functionEPSS 1.0%CVE-2023-28095HIGHOpenSIPS has vulnerability in the building the local negative repliesEPSS 1.0%CVE-2020-3317MEDIUMCisco Firepower Threat Defense Software SSL Input Validation Denial of Service VulnerabilityEPSS 1.0%CVE-2020-3519MEDIUMCisco Data Center Network Manager Path Traversal VulnerabilityEPSS 1.0%CVE-2020-3307MEDIUMCisco Firepower Management Center Arbitrary Log File Write VulnerabilityEPSS 1.0%