Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2018-19005—Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing EPSS 1.7%CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2024-49057HIGHMicrosoft Defender for Endpoint on Android Spoofing VulnerabilityEPSS 1.7%CVE-2019-1720MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.7%CVE-2020-27833—A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafEPSS 1.7%CVE-2022-4886HIGHIngress-nginx `path` sanitization can be bypassed with `log_format` directiveEPSS 1.7%CVE-2024-43455HIGHWindows Remote Desktop Licensing Service Spoofing VulnerabilityEPSS 1.7%CVE-2020-7880HIGHdouzone NeoRS remote support program ActiveX vulnerabilityEPSS 1.7%CVE-2021-1431HIGHCisco IOS XE SD-WAN Software vDaemon Denial of Service VulnerabilityEPSS 1.7%CVE-2023-27604HIGHApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityEPSS 1.7%CVE-2024-43592HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-43593HIGHWindows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2017-2617HIGHhawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a craEPSS 1.7%CVE-2020-8124—Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasEPSS 1.7%CVE-2026-34980MEDIUMOpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the networkEPSS 1.7%CVE-2019-1831MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.6%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%CVE-2025-34099CRITICALVICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth PasswordEPSS 1.6%CVE-2022-24423MEDIUMDell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially explEPSS 1.6%CVE-2025-43559CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 1.6%