Falhas do tipo CWE-20

5.389 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-66959HIGHAn issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoderEPSS 5.2%CVE-2024-30078HIGHWindows Wi-Fi Driver Remote Code Execution VulnerabilityEPSS 5.2%CVE-2011-0627HIGHAdobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to EPSS 5.1%CVE-2022-25167—Apache Flume vulnerable to a JNDI RCE in JMSSourceEPSS 5.1%CVE-2021-44548—Apache Solr information disclosure vulnerability through DataImportHandlerEPSS 5.1%CVE-2020-3327HIGHClamAV ARJ Archive Parsing Denial of Service VulnerabilityEPSS 5.1%CVE-2018-1060MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. AnEPSS 5.0%CVE-2018-16874MEDIUMIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path oEPSS 5.0%CVE-2020-7070MEDIUMPHP parses encoded cookie names so malicious `__Host-` cookies can be sentEPSS 5.0%CVE-2024-7340HIGHW&B Weave server remote arbitrary file leak and privilege escalationEPSS 5.0%CVE-2021-38000MEDIUMInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraEPSS 4.9%KEVCVE-2020-3218HIGHCisco IOS XE Software Web UI Remote Code Execution VulnerabilityEPSS 4.9%CVE-2020-6962—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 4.9%CVE-2018-1061MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK meEPSS 4.9%CVE-2026-48284CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 4.9%CVE-2016-10555—Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent tEPSS 4.9%CVE-2017-7481MEDIUMAnsible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the resultsEPSS 4.8%CVE-2018-14644MEDIUMAn issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type likEPSS 4.8%CVE-2024-7988CRITICALThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesEPSS 4.8%CVE-2026-40466HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIEPSS 4.8%