Falhas do tipo CWE-20

5.845 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2017-12277—A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300EPSS 3.8%CVE-2016-9577HIGHA vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messaEPSS 3.8%CVE-2023-3955HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 3.8%CVE-2018-0104—A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute aEPSS 3.8%CVE-2018-0274—A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbiEPSS 3.8%CVE-2019-1753HIGHCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 3.8%CVE-2018-0234—A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 SeriesEPSS 3.8%CVE-2026-13001CRITICALPodlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url ParameterEPSS 3.8%CVE-2022-42468CRITICALApache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceEPSS 3.7%CVE-2019-1756HIGHCisco IOS XE Software Command Injection VulnerabilityEPSS 3.7%CVE-2018-0287—A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteEPSS 3.7%CVE-2017-14023—An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versiEPSS 3.7%CVE-2020-10922HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware versEPSS 3.7%CVE-2018-20852MEDIUMhttp.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it canEPSS 3.7%CVE-2023-40062HIGHIncomplete List of Disallowed Inputs Remote Code Execution VulnerabilityEPSS 3.6%CVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.6%KEVCVE-2025-55692HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 3.6%CVE-2026-27304CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 3.6%CVE-2021-21372HIGHNimble arbitrary code execution for specially crafted package metadataEPSS 3.6%CVE-2026-12267HIGHAuthenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEEPSS 3.6%