Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-44386HIGHA denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A sEPSS 1.2%CVE-2022-36032MEDIUMReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentEPSS 1.2%CVE-2019-1830MEDIUMCisco Wireless LAN Controller Locally Significant Certificate Denial of Service VulnerabilityEPSS 1.2%CVE-2024-20004HIGHIn Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent EPSS 1.2%CVE-2026-110455HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in EPSS 1.2%CVE-2024-45167CRITICALAn issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and iEPSS 1.2%CVE-2021-26612HIGHtobesoft Nexacro platform arbitrary file creation vulnerabilityEPSS 1.2%CVE-2023-2454HIGHschema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attackeEPSS 1.2%CVE-2022-22525HIGHCommand injection in restore function of Carlo Gavazzi UWP3.0 allows for command injectionEPSS 1.2%CVE-2018-0237—A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could alloEPSS 1.2%CVE-2021-29431HIGHSSRF in Sydent due to missing validation of hostnamesEPSS 1.2%CVE-2016-10543—call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate EPSS 1.2%CVE-2022-44644MEDIUMApache Linkis (incubating): The DatasourceManager module has a Local File Read VulnerabilityEPSS 1.2%CVE-2024-22065MEDIUMZTE MF258 Pro product has a OS Command injection vulnerabilityEPSS 1.2%CVE-2021-20222—A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highesEPSS 1.2%CVE-2021-39193MEDIUMTransaction validity oversight in pallet-ethereumEPSS 1.2%CVE-2026-20967HIGHSystem Center Operations Manager (SCOM) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2023-35619MEDIUMMicrosoft Outlook for Mac Spoofing VulnerabilityEPSS 1.2%CVE-2018-10908MEDIUMIt was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafEPSS 1.2%CVE-2017-1002153—Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.EPSS 1.2%