Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-1263HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.5%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.5%CVE-2019-1951MEDIUMCisco SD-WAN Solution Packet Filtering Bypass VulnerabilityEPSS 1.5%CVE-2023-35303HIGHUSB Audio Class System Driver Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-24893HIGHopenITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro ExpansionEPSS 1.5%CVE-2022-32154MEDIUMRisky commands warnings in Splunk Enterprise DashboardsEPSS 1.5%CVE-2022-24774HIGHImproper Input Validation leading to Path Traversal in CycloneDX BOM Repository ServerEPSS 1.5%CVE-2022-24280MEDIUMApache Pulsar Proxy target broker address isn't validatedEPSS 1.5%CVE-2023-49291CRITICALImproper Sanitization of Branch Name Leads to Arbitrary Code InjectionEPSS 1.4%CVE-2021-1261HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2021-1260HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2020-7839HIGHMarkAny MaEPSBroker Command Injection VulnerabilityEPSS 1.4%CVE-2026-77533CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtEPSS 1.4%CVE-2026-77546CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2026-77543CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2026-77548CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtEPSS 1.4%CVE-2017-7653—The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other cliEPSS 1.4%CVE-2026-77547CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceEPSS 1.4%CVE-2021-23862HIGHAuthenticated Remote Code ExecutionEPSS 1.4%CVE-2025-25005MEDIUMMicrosoft Exchange Server Tampering VulnerabilityEPSS 1.4%