Falhas do tipo CWE-20

5.842 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-29371HIGHWindows GDI Elevation of Privilege VulnerabilityEPSS 5.4%CVE-2020-3252CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 5.3%CVE-2025-66959HIGHAn issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoderEPSS 5.3%CVE-2017-12319MEDIUMA vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow aEPSS 5.2%KEVCVE-2021-44548—Apache Solr information disclosure vulnerability through DataImportHandlerEPSS 5.2%CVE-2024-30078HIGHWindows Wi-Fi Driver Remote Code Execution VulnerabilityEPSS 5.2%CVE-2019-16056MEDIUMAn issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly EPSS 5.1%CVE-2011-0627HIGHAdobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to EPSS 5.1%CVE-2020-3327HIGHClamAV ARJ Archive Parsing Denial of Service VulnerabilityEPSS 5.1%CVE-2018-1060MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. AnEPSS 5.0%CVE-2018-16874MEDIUMIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path oEPSS 5.0%CVE-2020-7070MEDIUMPHP parses encoded cookie names so malicious `__Host-` cookies can be sentEPSS 5.0%CVE-2024-7340HIGHW&B Weave server remote arbitrary file leak and privilege escalationEPSS 5.0%CVE-2022-40773HIGHZoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows EPSS 5.0%CVE-2021-38000MEDIUMInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraEPSS 4.9%KEVCVE-2020-3218HIGHCisco IOS XE Software Web UI Remote Code Execution VulnerabilityEPSS 4.9%CVE-2020-6962—In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XEPSS 4.9%CVE-2018-14644MEDIUMAn issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type likEPSS 4.8%CVE-2016-10555—Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent tEPSS 4.8%CVE-2024-7988CRITICALThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesEPSS 4.8%