Falhas do tipo CWE-20

5.456 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2022-27828HIGHImproper validation vulnerability in MediaMonitorEvent prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.EPSS 0.1%CVE-2026-47542MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpEPSS 0.1%CVE-2026-47546MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validaEPSS 0.1%CVE-2025-13762MEDIUMClient-Side Denial of Service Condition in SWS Extension prior to version 2.2.30305EPSS 0.1%CVE-2025-4276HIGHUsbCoreDxe: improper input validation may lead to arbitrary code executionEPSS 0.1%CVE-2026-47543MEDIUMVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpuEPSS 0.1%CVE-2023-21671CRITICALImproper Input Validation in CoreEPSS 0.1%CVE-2026-47547MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validaEPSS 0.1%CVE-2022-27827HIGHImproper validation vulnerability in MediaMonitorDimension prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.EPSS 0.1%CVE-2026-21058MEDIUMImproper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' pEPSS 0.1%CVE-2026-47522MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpEPSS 0.1%CVE-2026-8579LOWInsufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised thEPSS 0.1%CVE-2025-4277HIGHTcg2Smm: improper input validation may lead to arbitrary code executionEPSS 0.1%CVE-2024-6978MEDIUMCato Networks Windows SDP Client Local root certificates can be installed by low-privileged usersEPSS 0.1%CVE-2026-92254MEDIUMWatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTLEPSS 0.1%CVE-2026-53411HIGHZoom Workplace VDI Plugin for Windows - Improper Input ValidationEPSS 0.1%CVE-2026-13929MEDIUMInsufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigationEPSS 0.1%CVE-2026-13808MEDIUMInsufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentiallyEPSS 0.1%CVE-2026-9987HIGHInsufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker toEPSS 0.1%CVE-2026-70603MEDIUMElectron: shell.openPath path validation bypass via embedded null byteEPSS 0.1%