Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2026-77540CRITICALA malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS EPSS 1.3%CVE-2026-77535CRITICALA malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi NetEPSS 1.3%CVE-2026-77542CRITICALA malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID EnterEPSS 1.3%CVE-2026-26106HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.3%CVE-2020-14338—A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of WildflEPSS 1.3%CVE-2020-15106MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2021-22766HIGHA CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All VersionsEPSS 1.3%CVE-2023-30442MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2026-42537CRITICALApache Ranger: Remote Code Execution via JDBC URL InjectionEPSS 1.3%CVE-2021-36321HIGHDell Networking X-Series firmware versions prior to 3.0.1.8 contain an improper input validation vulnerability. A remote unauthenticated attEPSS 1.3%CVE-2020-1662HIGHJunos OS and Junos OS Evolved: RPD crash due to BGP session flapping.EPSS 1.3%CVE-2022-2047LOWIn Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment oEPSS 1.3%CVE-2023-41748HIGHRemote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before buildEPSS 1.3%CVE-2023-41746HIGHRemote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before buildEPSS 1.3%CVE-2020-25626—A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST FramewEPSS 1.3%CVE-2025-34108HIGHDisk Pulse Enterprise 9.0.34 Login Stack Buffer OverflowEPSS 1.3%CVE-2026-85979HIGHCommand Injection in Puppet EnterpriseEPSS 1.3%CVE-2023-1973HIGHUndertow: unrestricted request storage leads to memory exhaustionEPSS 1.3%CVE-2020-3370MEDIUMCisco Content Security Management Appliance Filter Bypass VulnerabilityEPSS 1.3%CVE-2022-24905MEDIUMArgo CD login screen allows message spoofing if SSO is enabledEPSS 1.3%