Falhas do tipo CWE-20

5.418 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-27601HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2023-27600HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2022-26106—When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise VEPSS 1.0%CVE-2022-26109—When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise VieEPSS 1.0%CVE-2019-5461—An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary EPSS 1.0%CVE-2022-26107—When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer -EPSS 1.0%CVE-2026-48055CRITICALStreambert: Arbitrary File Write (Zip Slip) via Subtitle ExtractionEPSS 1.0%CVE-2025-8266MEDIUMyanyutao0402 ChanCMS collect.js getArticle deserializationEPSS 1.0%CVE-2018-0196—A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbEPSS 1.0%CVE-2023-1888HIGHDirectorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege EscalationEPSS 1.0%CVE-2026-32201MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.0%KEVCVE-2023-29195MEDIUMVitess VTAdmin users that can create shards can deny access to other functionsEPSS 1.0%CVE-2023-32323MEDIUMSynapse Outgoing federation to specific hosts can be disabled by sending malicious invitesEPSS 1.0%CVE-2023-28955MEDIUMIBM Watson Knowledge Catalog denial of serviceEPSS 1.0%CVE-2023-20072HIGHCisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service VulnerabilityEPSS 1.0%CVE-2021-34570HIGHPhoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTSEPSS 1.0%CVE-2021-22699—Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of EPSS 1.0%CVE-2025-14213HIGHCato's Socket WebUI is vulnerable to OS Command InjectionEPSS 1.0%CVE-2021-4219—A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw EPSS 1.0%CVE-2021-20252—A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateEPSS 1.0%