Falhas do tipo CWE-20

5.887 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2020-10715—A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbEPSS 0.9%CVE-2025-63213CRITICALThe QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validatiEPSS 0.9%CVE-2020-15190MEDIUMSegfault in TensorflowEPSS 0.9%CVE-2023-5964CRITICAL1E-Exchange-DisplayMessage instruction allows for arbitrary code executionEPSS 0.9%CVE-2023-45161CRITICAL1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code executionEPSS 0.9%CVE-2023-32485CRITICAL Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attackEPSS 0.9%CVE-2024-43755LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2024-20659HIGHWindows Hyper-V Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2024-52831LOWAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2023-38720MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2023-38740MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2020-5321HIGHDell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an imEPSS 0.9%CVE-2023-30987MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2023-27559MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2021-43861HIGHIncorrect sanitisation function leads to `XSS`EPSS 0.9%CVE-2023-40374MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2023-38728MEDIUMIBM Db2 denial of serviceEPSS 0.9%CVE-2023-42805HIGHquinn-proto Denial of Service vulnerabilityEPSS 0.9%CVE-2020-37216HIGHHirschmann HiOS EtherNet/IP Stack Denial of ServiceEPSS 0.9%CVE-2026-16139HIGHArbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code executionEPSS 0.9%