Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-22699—Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of EPSS 1.0%CVE-2021-34570HIGHPhoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTSEPSS 1.0%CVE-2021-1220MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 1.0%CVE-2023-42448HIGHHydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadlineEPSS 1.0%CVE-2021-1356MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 1.0%CVE-2021-4219—A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw EPSS 1.0%CVE-2023-45163CRITICAL1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code executionEPSS 1.0%CVE-2023-40372MEDIUMIBM Db2 denial of serviceEPSS 1.0%CVE-2023-40373MEDIUMIBM Db2 denial of serviceEPSS 1.0%CVE-2021-20252—A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateEPSS 1.0%CVE-2024-21374MEDIUMMicrosoft Teams for Android Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-63913HIGHnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction checkEPSS 1.0%CVE-2023-28513MEDIUMIBM MQ denial of serviceEPSS 1.0%CVE-2025-34159CRITICALCoolify Docker Compose Directive Injection in Application Deployment WorkflowEPSS 1.0%CVE-2022-2529HIGHMultiple DoS Attack Vectors in sflow packet handlingEPSS 1.0%CVE-2023-27599HIGHOpenSIPS has vulnerability in the parse_to_param() functionEPSS 1.0%CVE-2023-28095HIGHOpenSIPS has vulnerability in the building the local negative repliesEPSS 1.0%CVE-2020-3317MEDIUMCisco Firepower Threat Defense Software SSL Input Validation Denial of Service VulnerabilityEPSS 1.0%CVE-2020-3519MEDIUMCisco Data Center Network Manager Path Traversal VulnerabilityEPSS 1.0%CVE-2020-3307MEDIUMCisco Firepower Management Center Arbitrary Log File Write VulnerabilityEPSS 1.0%