Falhas do tipo CWE-20

5.399 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2022-26889HIGHPath Traversal in search parameter results in external content injectionEPSS 1.5%CVE-2025-43559CRITICALColdFusion | Improper Input Validation (CWE-20)EPSS 1.5%CVE-2025-53809MEDIUMWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.5%CVE-2023-29246HIGHApache OpenMeetings: allows null-byte InjectionEPSS 1.5%CVE-2022-43545CRITICALA vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MEPSS 1.5%CVE-2023-50262MEDIUMDompdf possible DoS caused by infinite recursion when parsing SVG imagesEPSS 1.5%CVE-2022-24093CRITICALAdobe Commerce post-auth improper input validation leads to remote code executionEPSS 1.5%CVE-2019-1951MEDIUMCisco SD-WAN Solution Packet Filtering Bypass VulnerabilityEPSS 1.5%CVE-2023-35303HIGHUSB Audio Class System Driver Remote Code Execution VulnerabilityEPSS 1.5%CVE-2022-24774HIGHImproper Input Validation leading to Path Traversal in CycloneDX BOM Repository ServerEPSS 1.5%CVE-2023-49291CRITICALImproper Sanitization of Branch Name Leads to Arbitrary Code InjectionEPSS 1.4%CVE-2025-30471HIGHA validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, maEPSS 1.4%CVE-2025-34105CRITICALDiskBoss Enterprise Stack-Based Buffer Overflow RCEEPSS 1.4%CVE-2022-24280MEDIUMApache Pulsar Proxy target broker address isn't validatedEPSS 1.4%CVE-2021-1263HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2016-8647LOWAn input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in EPSS 1.4%CVE-2024-34108CRITICALLarge attack surface through legit webhook usage in Adobe CommerceEPSS 1.4%CVE-2021-37206—A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsEPSS 1.4%CVE-2023-49299HIGHApache DolphinScheduler: Arbitrary js execute as root for authenticated usersEPSS 1.4%CVE-2018-15424—Multiple Vulnerabilities in Cisco Identity Services EngineEPSS 1.4%