Falhas do tipo CWE-20

5.847 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-3754—A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. ThisEPSS 2.2%CVE-2025-24970HIGHSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineEPSS 2.2%CVE-2023-36893MEDIUMMicrosoft Outlook Spoofing VulnerabilityEPSS 2.2%CVE-2022-47937CRITICALMultiple parsing problems in the Apache Sling Commons JSON moduleEPSS 2.2%CVE-2019-1740HIGHCisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service VulnerabilitiesEPSS 2.2%CVE-2021-3531—A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with twEPSS 2.2%CVE-2021-37533MEDIUMApache Commons Net's FTP client trusts the host from PASV response by defaultEPSS 2.2%CVE-2021-1299HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 2.2%CVE-2021-1298HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 2.2%CVE-2019-1743HIGHCisco IOS XE Software Arbitrary File Upload VulnerabilityEPSS 2.2%CVE-2020-3225HIGHCisco IOS and IOS XE Software Common Industrial Protocol Denial of Service VulnerabilitiesEPSS 2.2%CVE-2023-2728MEDIUMBypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginEPSS 2.2%CVE-2023-28710HIGHApache Airflow Spark Provider Arbitrary File Read via JDBCEPSS 2.2%CVE-2020-7588—A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2EPSS 2.2%CVE-2019-11247MEDIUMKubernetes kube-apiserver allows access to custom resources via wrong scopeEPSS 2.1%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2023-40272HIGHApache Airflow Spark Provider Arbitrary File Read via JDBCEPSS 2.1%CVE-2024-49033HIGHMicrosoft Word Security Feature Bypass VulnerabilityEPSS 2.1%CVE-2021-21408HIGHAccess to restricted PHP code by dynamic static class access in smartyEPSS 2.1%CVE-2020-25713—A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.EPSS 2.1%