Falhas do tipo CWE-20

5.842 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2018-0472—Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service VulnerabilityEPSS 16.2%CVE-2015-2291HIGH(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cEPSS 15.7%KEVCVE-2025-49719HIGHMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 15.5%CVE-2023-29464HIGHRockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information DisclosureEPSS 15.0%CVE-2020-5260CRITICALmalicious URLs may cause Git to present stored credentials to the wrong serverEPSS 14.9%CVE-2019-7193CRITICALThis improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP EPSS 14.4%KEVCVE-2023-23560CRITICALIn certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.EPSS 13.9%CVE-2017-12240CRITICALThe DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticatEPSS 13.8%KEVCVE-2023-3676HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 13.2%CVE-2018-1058—A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account couEPSS 13.1%CVE-2020-3387HIGHCisco SD-WAN vManage Software Remote Code Execution VulnerabilityEPSS 13.0%CVE-2023-28324HIGHA improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote cEPSS 12.9%CVE-2023-21434MEDIUMImproper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching EPSS 12.9%CVE-2019-3871MEDIUMA vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from theEPSS 12.6%CVE-2020-12001—FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContEPSS 11.8%CVE-2023-26068CRITICALCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).EPSS 11.6%CVE-2014-3480MEDIUMThe cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, dEPSS 11.5%CVE-2020-24432MEDIUMAcrobat Reader DC Arbitrary JavaScript Execution in PDF DocumentsEPSS 11.1%CVE-2025-6558HIGHInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiallEPSS 10.9%KEVCVE-2018-1140MEDIUMA missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw EPSS 10.9%