Falhas do tipo CWE-20

5.847 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-34056CRITICALAVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionEPSS 1.9%CVE-2021-20247—A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malEPSS 1.9%CVE-2022-43545CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.9%CVE-2020-16227—Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project EPSS 1.9%CVE-2021-26607HIGHTOBESOFT NEXACRO17 arbitrary command execution vulnerabilityEPSS 1.9%CVE-2023-51444HIGHGeoServer arbitrary file upload vulnerability in REST Coverage Store APIEPSS 1.9%CVE-2019-1983HIGHCisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service VulnerabilityEPSS 1.9%CVE-2018-15409—Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution VulnerabilitiesEPSS 1.9%CVE-2026-18911HIGHManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send reqEPSS 1.9%CVE-2020-3191HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPv6 DNS Denial of Service VulnerabilityEPSS 1.9%CVE-2022-47391HIGHCODESYS: Multiple products prone to Improper Input ValidationEPSS 1.9%CVE-2021-21388HIGHCommand Injection Vulnerability in systeminformationEPSS 1.9%CVE-2018-10888—A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound EPSS 1.8%CVE-2020-3228MEDIUMCisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Service VulnerabilityEPSS 1.8%CVE-2023-39357HIGHA Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in CactiEPSS 1.8%CVE-2019-1788HIGHClamAV OLE2 File Out-Of-Bounds Write VulnerabilityEPSS 1.8%CVE-2024-55020CRITICALA command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attEPSS 1.8%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2021-3572—A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue tEPSS 1.8%CVE-2019-12669MEDIUMCisco IOS and IOS XE Software Change of Authorization Denial of Service VulnerabilityEPSS 1.8%