Falhas do tipo CWE-20

5.426 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2022-45113MEDIUMImproper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafteEPSS 0.6%CVE-2023-31203MEDIUMImproper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow EPSS 0.6%CVE-2021-1482MEDIUMCisco SD-WAN vManage Authorization Bypass VulnerabilityEPSS 0.6%CVE-2023-21503MEDIUMPotential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attaEPSS 0.6%CVE-2023-21504MEDIUMPotential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackersEPSS 0.6%CVE-2025-5497MEDIUMslackero phpwcms Feedimport processing.inc.php deserializationEPSS 0.6%CVE-2023-39539HIGHFailure when uploading a Logo image fileEPSS 0.6%CVE-2026-74761HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdEPSS 0.6%CVE-2025-31132HIGHRaven allows Remote Code Execution due to improper validationEPSS 0.6%CVE-2026-3204CRITICALImproper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displaEPSS 0.6%CVE-2026-5536MEDIUMFedML-AI FedML gRPC server grpc_server.py sendMessage deserializationEPSS 0.6%CVE-2023-36462MEDIUMMastodon's verified profile links can be formatted in a misleading wayEPSS 0.6%CVE-2023-22898MEDIUMworkers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIPEPSS 0.6%CVE-2022-20545HIGHIn bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input validation. This could lEPSS 0.6%CVE-2022-22247HIGHJunos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS)EPSS 0.6%CVE-2024-26151HIGHPotentially untrusted input is rendered as HTML in final outputEPSS 0.6%CVE-2026-7195HIGHCWE-20: Improper Input Validation in web services in Progress SitefinityEPSS 0.6%CVE-2023-51931HIGHAn issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.EPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2023-29026MEDIUMRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.6%