Falhas do tipo CWE-20

5.418 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2021-23035—On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked respEPSS 0.9%CVE-2021-35533HIGHSpecially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 seriesEPSS 0.9%CVE-2021-23034—On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual seEPSS 0.9%CVE-2021-23039—On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configEPSS 0.9%CVE-2024-20659HIGHWindows Hyper-V Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2021-20326MEDIUMSpecially crafted query may result in a denial of service of mongodEPSS 0.9%CVE-2023-49082MEDIUMaiohttp's ClientSession is vulnerable to CRLF injection via methodEPSS 0.9%CVE-2022-28328—A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALAEPSS 0.9%CVE-2021-22277HIGHAC 800M MMS - Denial of Service vulnerability in MMS communicationEPSS 0.9%CVE-2020-10715—A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbEPSS 0.9%CVE-2025-47777CRITICAL5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)EPSS 0.9%CVE-2022-43723HIGHA vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software dEPSS 0.9%CVE-2021-1220MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 0.9%CVE-2021-1356MEDIUMCisco IOS XE Software Web UI Denial of Service VulnerabilitiesEPSS 0.9%CVE-2020-15190MEDIUMSegfault in TensorflowEPSS 0.9%CVE-2022-36362HIGHA vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versionsEPSS 0.9%CVE-2022-45872CRITICALiTerm2 before 3.4.18 mishandles a DECRQSS response.EPSS 0.9%CVE-2024-52831LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2024-43755LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2021-1286MEDIUMCisco Data Center Network Manager VulnerabilitiesEPSS 0.9%