Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-25436—Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via EPSS 1.6%CVE-2021-28655MEDIUMApache Zeppelin: Arbitrary file deletion vulnerabilityEPSS 1.6%CVE-2021-21060MEDIUMAcrobat Pro DC Improper File Parsing Could Lead to Information DisclosureEPSS 1.6%CVE-2023-38254MEDIUMMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12218—A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email SeEPSS 1.6%CVE-2021-30004MEDIUMIn wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x5EPSS 1.6%CVE-2021-1304HIGHCisco SD-WAN vManage Authorization Bypass VulnerabilitiesEPSS 1.6%CVE-2026-77554CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exeEPSS 1.6%CVE-2017-6021—In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, EPSS 1.6%CVE-2026-77537CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to EPSS 1.6%CVE-2026-77552CRITICALA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video EPSS 1.6%CVE-2021-1508CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2021-1505CRITICALCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.6%CVE-2026-50748CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.6%CVE-2022-36085HIGHOPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functionsEPSS 1.6%CVE-2021-21322CRITICALPrefix escapeEPSS 1.6%CVE-2026-28336CRITICALSolarWinds Dameware Command Injection VulnerabilityEPSS 1.6%CVE-2020-25717—A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilegEPSS 1.6%CVE-2020-7869CRITICALAn improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fEPSS 1.6%CVE-2022-3294MEDIUMNode address isn't always verified when proxyingEPSS 1.6%