Falhas do tipo CWE-20

5.455 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-43293MEDIUMThe issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An appEPSS 0.2%CVE-2024-30916MEDIUMAn issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensiEPSS 0.2%CVE-2026-22611LOWAWS SDK for .NET V4 adopted defense in depth enhancement for region parameter valueEPSS 0.2%CVE-2025-5090HIGHArista CloudVision Exchange Cluster Instability via Unexpected Switch MessagesEPSS 0.2%CVE-2022-34152HIGHImproper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged userEPSS 0.2%CVE-2026-10021HIGHInsufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary coEPSS 0.2%CVE-2026-11146CRITICALInsufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisEPSS 0.2%CVE-2023-45172MEDIUMIBM AIX denial of serviceEPSS 0.2%CVE-2026-11063CRITICALInsufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had comEPSS 0.2%CVE-2026-11119CRITICALInappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2026-14073MEDIUMInsufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation rEPSS 0.2%CVE-2026-11202HIGHInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perfoEPSS 0.2%CVE-2026-11056CRITICALInsufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker whoEPSS 0.2%CVE-2022-30744MEDIUMDLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code.EPSS 0.2%CVE-2026-11041HIGHInsufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had comEPSS 0.2%CVE-2025-12718MEDIUMQuick Contact Form <= 8.2.6 - Unauthenticated Open Mail RelayEPSS 0.2%CVE-2026-11272HIGHInsufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convEPSS 0.2%CVE-2024-25942MEDIUMDell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker couEPSS 0.2%CVE-2026-87469MEDIUMImproper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into aEPSS 0.2%CVE-2026-11029HIGHInsufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker whoEPSS 0.2%