Falhas do tipo CWE-20

5.842 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2026-40466HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIEPSS 4.8%CVE-2018-10916MEDIUMIt has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrEPSS 4.8%CVE-2014-2532MEDIUMsshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass inEPSS 4.8%CVE-2017-7481MEDIUMAnsible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the resultsEPSS 4.7%CVE-2018-1061MEDIUMpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK meEPSS 4.7%CVE-2026-12268HIGHAuthenticated PowerShell Injection leads to RCEEPSS 4.7%CVE-2025-61812HIGHColdFusion | Improper Input Validation (CWE-20)EPSS 4.7%CVE-2023-21607HIGHAdobe Acrobat Reader Improper Input Validation Remote Code Execution VulnerabilityEPSS 4.7%CVE-2019-1845HIGHCisco Unified Communications Manager IM&P Service, Cisco TelePresence VCS, and Cisco Expressway Series Denial of Service VulnerabilityEPSS 4.6%CVE-2018-14630HIGHmoodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution.EPSS 4.6%CVE-2016-7069MEDIUMAn issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdistEPSS 4.6%CVE-2022-2856MEDIUMInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitEPSS 4.6%KEVCVE-2021-33527CRITICALOS Command Injection in mbDIALUP <= 3.9R0.0EPSS 4.5%CVE-2023-34448HIGHGrav Server-side Template Injection (SSTI) via Twig Default FiltersEPSS 4.5%CVE-2024-31449HIGHLua library commands may lead to stack overflow and RCE in RedisEPSS 4.5%CVE-2016-8612—Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in thEPSS 4.4%CVE-2018-0231—A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower ThreatEPSS 4.4%CVE-2021-1138CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2021-1140CRITICALCisco Smart Software Manager Satellite Web UI Command Injection VulnerabilitiesEPSS 4.4%CVE-2019-1822HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilitiesEPSS 4.4%