Falhas do tipo CWE-20

5.455 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2026-17767MEDIUMInsufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had cEPSS 0.3%CVE-2025-24510HIGHA vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnetEPSS 0.3%CVE-2026-14414MEDIUMInsufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2025-55058MEDIUMCWE-20 Improper Input ValidationEPSS 0.3%CVE-2026-11660HIGHInsufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had comproEPSS 0.3%CVE-2026-47880MEDIUMDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesEPSS 0.3%CVE-2026-13990MEDIUMInsufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who EPSS 0.3%CVE-2026-8369MEDIUMImproper Input Validation in OpenThread NAT64 TranslatorEPSS 0.3%CVE-2026-9031MEDIUMAuthenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6EPSS 0.3%CVE-2026-78943LOWImproper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2026-7968LOWInsufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised theEPSS 0.3%CVE-2026-79066LOWImproper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2026-62656MEDIUMPost-authenticated command injection vulnerability found in certain NETGEAR RAX modelsEPSS 0.3%CVE-2021-26316HIGHFailure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resultingEPSS 0.3%CVE-2026-21083MEDIUMImproper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.EPSS 0.3%CVE-2021-44454HIGHImproper input validation in a third-party component for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticateEPSS 0.3%CVE-2026-9950LOWInsufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromiEPSS 0.3%CVE-2026-7966LOWInsufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had comproEPSS 0.3%CVE-2022-1108MEDIUMA potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could beEPSS 0.3%CVE-2026-79203LOWImproper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proEPSS 0.3%