Falhas do tipo CWE-20

5.386 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-12029CRITICALRockwell Automation FactoryTalk View SEEPSS 47.0%CVE-2024-20017CRITICALIn wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no EPSS 46.6%CVE-2019-15276HIGHCisco Wireless LAN Controller HTTP Parsing Engine Denial of Service VulnerabilityEPSS 46.3%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 44.8%CVE-2026-32201MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 43.4%KEVCVE-2023-21818HIGHWindows Secure Channel Denial of Service VulnerabilityEPSS 43.2%CVE-2018-25031MEDIUMSwagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attEPSS 42.3%CVE-2026-12569CRITICALRemote Code Execution (RCE) vulnerability in Windchill PDMlinkEPSS 40.6%KEVCVE-2023-2914HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyEPSS 39.9%CVE-2013-6282HIGHThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addEPSS 39.7%KEVCVE-2019-1936HIGHCisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection VulnerabilityEPSS 39.5%CVE-2020-3240CRITICALMultiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big DataEPSS 38.7%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2022-28127HIGHA data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted networkEPSS 37.9%CVE-2023-26067HIGHCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).EPSS 37.8%CVE-2017-12285—A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbEPSS 37.2%CVE-2024-39573HIGHApache HTTP Server: mod_rewrite proxy handler substitutionEPSS 37.2%CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-22476CRITICALImproper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially EPSS 36.0%CVE-2025-1097HIGHingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationEPSS 35.5%