Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-24683MEDIUMApache Hop Engine: ID isn't escaped when generating HTMLEPSS 1.2%CVE-2018-0135—A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an EPSS 1.2%CVE-2026-81995CRITICALAdobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)EPSS 1.2%CVE-2026-27953HIGHormar has a Pydantic Validation Bypass via Kwargs Injection in Model ConstructorEPSS 1.2%CVE-2022-44617HIGHA flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly EPSS 1.2%CVE-2022-22727—A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact EPSS 1.2%CVE-2020-3238HIGHCisco IOx Application Framework Arbitrary File Creation VulnerabilityEPSS 1.2%CVE-2016-7073MEDIUMAn issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-EPSS 1.2%CVE-2022-25940HIGHDenial of Service (DoS)EPSS 1.2%CVE-2026-50328HIGHWindows Server Update Service (WSUS) Tampering VulnerabilityEPSS 1.2%CVE-2022-4904HIGHA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possiEPSS 1.2%CVE-2021-31372HIGHJunos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root.EPSS 1.2%CVE-2025-30355HIGHSynapse vulnerable to federation denial of service via malformed eventsEPSS 1.2%CVE-2020-3478HIGHCisco Enterprise NFV Infrastructure Software File Overwrite VulnerabilityEPSS 1.2%CVE-2016-7074MEDIUMAn issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-EPSS 1.2%CVE-2021-43588MEDIUMDell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could pEPSS 1.2%CVE-2021-41114MEDIUMHTTP Host Header Injection in Request Handling in Typo3EPSS 1.2%CVE-2024-45219HIGHApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureEPSS 1.2%CVE-2023-21685HIGHMicrosoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityEPSS 1.2%CVE-2026-54501CRITICALBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom BehaviorsEPSS 1.2%