Falhas do tipo CWE-20

5.847 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-33592—NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in fileEPSS 2.1%CVE-2024-26164HIGHMicrosoft Django Backend for SQL Server Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-27660HIGHC-CURE 9000EPSS 2.1%CVE-2021-21705MEDIUMIncorrect URL validation in FILTER_VALIDATE_URLEPSS 2.1%CVE-2021-21267HIGHRegular Expression Denial-of-Service in npm schema-inspectorEPSS 2.1%CVE-2021-42786CRITICALRemote Code Execution at AgentControllerServletEPSS 2.1%CVE-2024-2443CRITICALImproper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleEPSS 2.1%CVE-2020-15258HIGHInsecure use of shell.openExternal in WireEPSS 2.1%CVE-2023-24937MEDIUMWindows CryptoAPI Denial of Service VulnerabilityEPSS 2.1%CVE-2018-14631HIGHmoodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumEPSS 2.1%CVE-2022-43546CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 2.1%CVE-2017-16753—An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause EPSS 2.1%CVE-2026-47928CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 2.1%CVE-2019-11781MEDIUMImproper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackeEPSS 2.1%CVE-2023-32462CRITICAL Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authenticatioEPSS 2.1%CVE-2021-25742HIGHIngress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesEPSS 2.1%CVE-2023-36912HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.1%CVE-2019-18228—Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HEPSS 2.1%CVE-2021-1275CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.1%CVE-2018-10891MEDIUMA flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the questEPSS 2.1%