Falhas do tipo CWE-20

5.393 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2018-8867—In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystemsEPSS 3.4%CVE-2024-20733MEDIUM[ZS-VR-23-360] Adobe Acrobat Reader Parsing OTF font Denial-of-Service VulnerabilityEPSS 3.4%CVE-2019-1754HIGHCisco IOS XE Software Privilege Escalation VulnerabilityEPSS 3.4%CVE-2019-1755MEDIUMCisco IOS XE Software Command Injection VulnerabilityEPSS 3.4%CVE-2025-55692HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 3.4%CVE-2018-0239—A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASEPSS 3.4%CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2020-3341HIGHClamAV PDF Parsing Denial of Service VulnerabilityEPSS 3.4%CVE-2018-11615—This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required toEPSS 3.3%CVE-2018-0280—A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, rEPSS 3.3%CVE-2018-0325—A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP PhoneEPSS 3.3%CVE-2018-10929HIGHA flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitraryEPSS 3.3%CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.3%CVE-2025-34115HIGHOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.phpEPSS 3.3%CVE-2009-2055MEDIUMCisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalEPSS 3.3%KEVCVE-2020-25643—A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by iEPSS 3.3%CVE-2019-9503HIGHBroadcom brcmfmac driver is vulnerable to a frame validation bypassEPSS 3.3%CVE-2019-15958HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilityEPSS 3.3%CVE-2023-40743CRITICALApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceEPSS 3.3%CVE-2019-15957HIGHCisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection VulnerabilityEPSS 3.2%