Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-28590HIGHAn out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master CEPSS 1.3%CVE-2021-32642HIGHMissing input validation in dynamic discovery example scripts.EPSS 1.3%CVE-2021-40423HIGHA denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A spEPSS 1.3%CVE-2023-30447MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2023-30446MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2021-1464MEDIUMCisco SD-WAN vManage Authorization Bypass VulnerabilityEPSS 1.3%CVE-2016-8651LOWAn input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with aEPSS 1.3%CVE-2025-12543CRITICALUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfEPSS 1.3%CVE-2020-8568MEDIUMKubernetes Secrets Store CSI Driver sync/rotate directory traversalEPSS 1.3%CVE-2021-42787CRITICALDirectory Traversal Write/Delete/Partial Read at AgentConfigurationServletEPSS 1.3%CVE-2022-22241HIGHJunos OS: Vulnerability in J-Web may allow deserialization without authenticationEPSS 1.3%CVE-2022-47894MEDIUMApache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXEEPSS 1.3%CVE-2022-2047LOWIn Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment oEPSS 1.3%CVE-2024-41116CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_paramsEPSS 1.3%CVE-2024-41117CRITICALRemote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.pyEPSS 1.3%CVE-2019-19337MEDIUMA flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker cEPSS 1.3%CVE-2022-21646HIGHLookup operations do not take into account wildcards in SpiceDBEPSS 1.3%CVE-2023-24807HIGHUndici vulnerable to Regular Expression Denial of Service in HeadersEPSS 1.3%CVE-2020-15170HIGHMissing access control in apollo-adminserviceEPSS 1.3%CVE-2024-32007HIGHApache CXF Denial of Service vulnerability in JOSEEPSS 1.3%