Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-27828—There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitraryEPSS 1.4%CVE-2018-10843HIGHsource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to EPSS 1.4%CVE-2017-2653MEDIUMA number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesEPSS 1.4%CVE-2024-46946CRITICALlangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through syEPSS 1.4%CVE-2019-1905MEDIUMCisco Email Security Appliance GZIP Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2024-34109HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 1.4%CVE-2022-25751—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.4%CVE-2024-45169CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.4%CVE-2018-7531—An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidaEPSS 1.4%CVE-2026-93952CRITICALSecurity Advisory 0183EPSS 1.4%KEVCVE-2021-41138MEDIUMValidity check for signed Frontier-specific extrinsic not called in block executionEPSS 1.4%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.4%CVE-2020-3133MEDIUMCisco Email Security Appliance Content Filter Bypass VulnerabilityEPSS 1.4%CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-7014HIGHImproper multimedia file attachment validation in Telegram for Android appEPSS 1.4%CVE-2019-15289HIGHCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilitiesEPSS 1.4%CVE-2019-15261HIGHCisco Aironet Access Points Point-to-Point Tunneling Protocol Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3526HIGHCisco IOS XE Software Common Open Policy Service Engine Denial of Service VulnerabilityEPSS 1.4%CVE-2018-0438—Cisco Umbrella Enterprise Roaming Client Privilege Escalation VulnerabilityEPSS 1.4%CVE-2020-3527HIGHCisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service VulnerabilityEPSS 1.4%