Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-30442MEDIUMIBM Db2 denial of serviceEPSS 1.3%CVE-2021-36321HIGHDell Networking X-Series firmware versions prior to 3.0.1.8 contain an improper input validation vulnerability. A remote unauthenticated attEPSS 1.3%CVE-2026-42537CRITICALApache Ranger: Remote Code Execution via JDBC URL InjectionEPSS 1.3%CVE-2020-7504—A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker toEPSS 1.3%CVE-2020-1662HIGHJunos OS and Junos OS Evolved: RPD crash due to BGP session flapping.EPSS 1.3%CVE-2023-41748HIGHRemote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before buildEPSS 1.3%CVE-2023-41746HIGHRemote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before buildEPSS 1.3%CVE-2022-36058HIGHelrond-go MultiESDTNFTTransfer call on a SC address with missing function nameEPSS 1.3%CVE-2026-85979HIGHCommand Injection in Puppet EnterpriseEPSS 1.3%CVE-2023-1973HIGHUndertow: unrestricted request storage leads to memory exhaustionEPSS 1.3%CVE-2025-31281CRITICALAn input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, EPSS 1.3%CVE-2025-31233MEDIUMThe issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5EPSS 1.3%CVE-2024-3657HIGH389-ds-base: potential denial of service via specially crafted kerberos as-req requestEPSS 1.3%CVE-2020-3370MEDIUMCisco Content Security Management Appliance Filter Bypass VulnerabilityEPSS 1.3%CVE-2021-40127MEDIUMCisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service VulnerabilityEPSS 1.3%CVE-2020-3164MEDIUMCisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service VulnerabilityEPSS 1.3%CVE-2024-38194HIGHAzure Web Apps Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2019-10937—A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could causeEPSS 1.3%CVE-2022-30232HIGHA CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercEPSS 1.3%CVE-2021-22766HIGHA CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All VersionsEPSS 1.3%