Falhas do tipo CWE-20

5.456 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-53030HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2024-53031HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2024-53022HIGHImproper Input Validation in Automotive OS PlatformEPSS 0.1%CVE-2025-20056MEDIUMImproper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of prEPSS 0.1%CVE-2025-43365LOWA denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadEPSS 0.1%CVE-2025-25216LOWImproper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow EPSS 0.1%CVE-2024-23362HIGHImproper Input Validation in Trusted Execution EnvironmentEPSS 0.1%CVE-2023-28578CRITICALImproper Input Validation in ServicesEPSS 0.1%CVE-2026-10566MEDIUMFoundationAgents MetaGPT schema.py Message.check_instruct_content deserializationEPSS 0.1%CVE-2025-22453HIGHImproper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allEPSS 0.1%CVE-2023-21627MEDIUMIncorrect Type Conversion or Cast in Trusted Execution EnvironmentEPSS 0.1%CVE-2021-30299MEDIUMImproper Input Validation in AudioEPSS 0.1%CVE-2025-25210HIGHImproper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allEPSS 0.1%CVE-2026-13942LOWInappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoEPSS 0.1%CVE-2022-22264HIGHImproper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary filEPSS 0.1%CVE-2025-25212LOWpasteboard has an improper input vulnerabilityEPSS 0.1%CVE-2026-19543MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.1%CVE-2021-25517HIGHAn improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution.EPSS 0.1%CVE-2021-25339MEDIUMImproper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernelEPSS 0.1%CVE-2024-33065HIGHImproper Input Validation in CameraEPSS 0.1%