Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-3526HIGHCisco IOS XE Software Common Open Policy Service Engine Denial of Service VulnerabilityEPSS 1.4%CVE-2020-3475MEDIUMCisco IOS XE Software Web Management Framework VulnerabilitiesEPSS 1.4%CVE-2023-30449HIGHIBM Db2 denial of serviceEPSS 1.4%CVE-2023-30445HIGHIBM Db2 denial of serviceEPSS 1.4%CVE-2022-45470HIGHApache Hama allows XSS and information disclosureEPSS 1.4%CVE-2024-31862MEDIUMApache Zeppelin: Denial of service with invalid notebook nameEPSS 1.4%CVE-2026-50012MEDIUMSquid: Memory corruption in cache_digest reply handlingEPSS 1.4%CVE-2021-1262HIGHCisco SD-WAN Command Injection VulnerabilitiesEPSS 1.4%CVE-2018-12474MEDIUMCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmEPSS 1.4%CVE-2024-26189HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.4%CVE-2020-7849HIGHUPRISM CURIX arbitrary code execution vulnerabilityEPSS 1.4%CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.4%CVE-2019-1678MEDIUMCisco Meeting Server Denial of Service VulnerabilityEPSS 1.4%CVE-2022-29897CRITICALRemote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACTEPSS 1.4%CVE-2023-30448MEDIUMIBM Db2 denial of serviceEPSS 1.4%CVE-2020-3358HIGHCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Denial of Service VulnerabilityEPSS 1.4%CVE-2025-31208HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS SonoEPSS 1.4%CVE-2023-39532CRITICALSES's dynamic import and spread operator provides possible path to arbitrary exfiltration and executionEPSS 1.3%CVE-2019-1886HIGHCisco Web Security Appliance HTTPS Certificate Denial of Service VulnerabilityEPSS 1.3%CVE-2020-15174HIGHUnpreventable top-level navigation in ElectronEPSS 1.3%