Fallos del tipo CWE-20

5887 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-27304CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 3.8%CVE-2017-12277—A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300EPSS 3.8%CVE-2016-9577HIGHA vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messaEPSS 3.8%CVE-2023-3955HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 3.8%CVE-2018-0104—A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute aEPSS 3.8%CVE-2018-0274—A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbiEPSS 3.8%CVE-2019-1753HIGHCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 3.8%CVE-2018-0234—A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 SeriesEPSS 3.8%CVE-2026-13001CRITICALPodlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url ParameterEPSS 3.8%CVE-2022-42468CRITICALApache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceEPSS 3.7%CVE-2019-1756HIGHCisco IOS XE Software Command Injection VulnerabilityEPSS 3.7%CVE-2018-0287—A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteEPSS 3.7%CVE-2017-14023—An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versiEPSS 3.7%CVE-2020-10922HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware versEPSS 3.7%CVE-2018-20852MEDIUMhttp.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it canEPSS 3.7%CVE-2023-40062HIGHIncomplete List of Disallowed Inputs Remote Code Execution VulnerabilityEPSS 3.6%CVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.6%KEVCVE-2025-55692HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 3.6%CVE-2021-21372HIGHNimble arbitrary code execution for specially crafted package metadataEPSS 3.6%CVE-2026-12267HIGHAuthenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEEPSS 3.6%