Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-25581HIGHTransfer requests received over DoH can lead to a denial of service in DNSdistEPSS 1.1%CVE-2023-40699HIGHIBM InfoSphere Information Server denial of serviceEPSS 1.1%CVE-2026-93568HIGHIo.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requestsEPSS 1.1%CVE-2020-3546MEDIUMCisco Email Security Appliance Information Disclosure VulnerabilityEPSS 1.1%CVE-2019-16029HIGHCisco Smart Software Manager On-Prem Web Interface Denial of Service VulnerabilityEPSS 1.1%CVE-2025-64989HIGHCommand Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash InstructionEPSS 1.1%CVE-2026-22563CRITICALA series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play netEPSS 1.1%CVE-2021-1470MEDIUMCisco SD-WAN SQL Injection VulnerabilityEPSS 1.1%CVE-2025-50151HIGHApache Jena: Configuration files uploaded by administrative users are not check properlyEPSS 1.1%CVE-2023-6012HIGHIncorrect input data validation in Lanaccess ONSAFE MonitorHM Web ConsoleEPSS 1.1%CVE-2021-1534MEDIUMCisco Email Security Appliance URL Filtering Bypass VulnerabilityEPSS 1.1%CVE-2021-22787HIGHA CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a speciallyEPSS 1.1%CVE-2022-47191MEDIUMPrivilege Escalation via file upload vulnerability at Generex CS141EPSS 1.1%CVE-2022-22538—When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise ViewEPSS 1.1%CVE-2026-0404MEDIUMInsufficient input validation in NETGEAR Orbi routersEPSS 1.1%CVE-2020-27823—A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during enEPSS 1.1%CVE-2022-24806MEDIUMnet-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneouslyEPSS 1.1%CVE-2024-26240HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.1%CVE-2022-32797HIGHThis issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS MontereEPSS 1.1%CVE-2013-4144—There is an object injection vulnerability in swfupload plugin for wordpress.EPSS 1.1%