Falhas do tipo CWE-20

5.845 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-2000HIGHPAN-OS: OS command injection and memory corruption vulnerabilityEPSS 3.4%CVE-2018-0239—A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASEPSS 3.4%CVE-2025-24513MEDIUMingress-nginx controller - auth secret file path traversal vulnerabilityEPSS 3.3%CVE-2026-5174HIGHImproper Access Control Vulnerability in Progress MOVEit AutomationEPSS 3.3%CVE-2009-2055MEDIUMCisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalEPSS 3.3%KEVCVE-2020-25643—A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by iEPSS 3.3%CVE-2022-26782CRITICALMultiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.EPSS 3.3%CVE-2022-26780CRITICALMultiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.EPSS 3.3%CVE-2022-20698HIGHClam AntiVirus (ClamAV) Denial of Service VulnerabilityEPSS 3.3%CVE-2019-15958HIGHCisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilityEPSS 3.3%CVE-2019-9503HIGHBroadcom brcmfmac driver is vulnerable to a frame validation bypassEPSS 3.3%CVE-2023-40743CRITICALApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceEPSS 3.3%CVE-2019-15957HIGHCisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection VulnerabilityEPSS 3.2%CVE-2018-10920HIGHImproper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.EPSS 3.2%CVE-2018-11615—This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required toEPSS 3.2%CVE-2018-0325—A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP PhoneEPSS 3.2%CVE-2018-0280—A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, rEPSS 3.2%CVE-2018-10903HIGHA flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. IEPSS 3.2%CVE-2018-19016—Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB VerEPSS 3.2%CVE-2021-20611HIGHImproper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, EPSS 3.2%