Falhas do tipo CWE-20

5.847 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2018-15369—Cisco IOS and IOS XE Software TACACS+ Client Denial of Service VulnerabilityEPSS 2.1%CVE-2023-28707HIGHAirflow Apache Drill Provider Arbitrary File Read VulnerabilityEPSS 2.1%CVE-2022-43439CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0EPSS 2.1%CVE-2024-6436HIGHRockwell Automation Input Validation Vulnerability exists in the SequenceManager™ ServerEPSS 2.1%CVE-2019-1697MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Lightweight Directory Access Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1806HIGHCisco Small Business Series Switches Simple Network Management Protocol Denial of Service VulnerabilityEPSS 2.0%CVE-2023-32015CRITICALWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-36706MEDIUMWindows Deployment Services Information Disclosure VulnerabilityEPSS 2.0%CVE-2019-1721HIGHCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 2.0%CVE-2014-0761—CG Automation ePAQ-9410 Substation Gateway Improper Input ValidationEPSS 2.0%CVE-2025-29968MEDIUMActive Directory Certificate Services (AD CS) Denial of Service VulnerabilityEPSS 2.0%CVE-2018-7511—In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in EPSS 2.0%CVE-2021-1468CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 2.0%CVE-2020-1695HIGHA flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an impropeEPSS 2.0%CVE-2023-36821HIGHUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationEPSS 2.0%CVE-2018-15410—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15418—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15421—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15419—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 2.0%CVE-2018-15422—Cisco Webex Network Recording Player Remote Code Execution VulnerabilitiesEPSS 2.0%