Falhas do tipo CWE-20

5.888 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2022-41214HIGHDue to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges EPSS 0.9%CVE-2024-55952HIGHDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 0.9%CVE-2022-31036MEDIUMSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverEPSS 0.9%CVE-2023-4043MEDIUMParsson DoS when parsing numbers from untrusted sourcesEPSS 0.9%CVE-2021-37707MEDIUMManipulation of product reviews via APIEPSS 0.9%CVE-2026-45391HIGHLocal privilege escalation in Cribl Edge for LinuxEPSS 0.9%CVE-2022-22658MEDIUMAn input validation issue was addressed with improved input validation. This issue is fixed in iOS 16.0.3. Processing a maliciously crafted EPSS 0.9%CVE-2020-1676HIGHJuniper Networks Mist Cloud UI: SAML authentication response handling vulnerability.EPSS 0.9%CVE-2022-38778MEDIUMA flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requEPSS 0.9%CVE-2023-22465HIGHHttp4s has fatal error parsing User-Agent and Server headersEPSS 0.9%CVE-2022-26108—When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versionEPSS 0.9%CVE-2022-22537—When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise ViewerEPSS 0.9%CVE-2023-20270MEDIUMA vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco FEPSS 0.9%CVE-2023-34317MEDIUMAn improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18EPSS 0.9%CVE-2025-52907HIGHTOTOLINK X6000R Security Bypass VulnerabilityEPSS 0.9%CVE-2023-42661HIGHJFrog Artifactory Improper input validation leads to arbitrary file writeEPSS 0.9%CVE-2023-40034HIGHRepositoty takeover in woodpecker-ciEPSS 0.9%CVE-2023-49081HIGHaiohttp's ClientSession is vulnerable to CRLF injection via versionEPSS 0.9%CVE-2026-95631HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.9%CVE-2023-5832CRITICALImproper Input Validation in mintplex-labs/anything-llmEPSS 0.9%