Falhas do tipo CWE-20

5.399 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-37415HIGHApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userEPSS 1.6%CVE-2026-25892HIGHAdminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version EndpointEPSS 1.6%CVE-2018-0394—A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain resEPSS 1.6%CVE-2020-1757HIGHA flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unEPSS 1.6%CVE-2024-34693MEDIUMApache Superset: Server arbitrary file readEPSS 1.6%CVE-2022-24952—Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalidEPSS 1.6%CVE-2017-12244—A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote aEPSS 1.6%CVE-2021-28585MEDIUMMagento Commerce improper input validation in customer customer webapiEPSS 1.6%CVE-2020-7841HIGHTOBESOFT XPLATFORM arbitrary hta file execution vulnerabilityEPSS 1.6%CVE-2019-1689HIGHCisco Webex Teams for iOS Arbitrary File Upload VulnerabilityEPSS 1.6%CVE-2022-39312CRITICALDataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityEPSS 1.6%CVE-2022-47190CRITICALRCE via file upload vulnerability in Generex CS141EPSS 1.6%CVE-2019-1984MEDIUMCisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write VulnerabilityEPSS 1.6%CVE-2021-42854CRITICALDirectory Traversal Read/Write/Delete at PluginServletEPSS 1.6%CVE-2021-42853CRITICALDirectory Traversal Delete/Read at AgentDiagnosticServletEPSS 1.6%CVE-2018-19008—The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor whEPSS 1.6%CVE-2020-5238MEDIUMDenial of service in table parsing in cmark-gfmEPSS 1.6%CVE-2022-39281MEDIUMRemote Denial of Service via Tasks endpoint in fat_free_crmEPSS 1.6%CVE-2020-3441MEDIUMCisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityEPSS 1.6%CVE-2024-37373HIGHImproper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achEPSS 1.6%