Falhas do tipo CWE-20

5.418 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-21194HIGHMicrosoft Surface Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2025-10155CRITICALPickleScan Security Bypass Using Misleading File ExtensionEPSS 0.8%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 0.8%CVE-2023-0100—In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTEPSS 0.8%CVE-2024-45117HIGHAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.8%CVE-2025-52907HIGHTOTOLINK X6000R Security Bypass VulnerabilityEPSS 0.8%CVE-2024-47823HIGHLivewire Remote Code Execution (RCE) on File UploadsEPSS 0.8%CVE-2022-22658MEDIUMAn input validation issue was addressed with improved input validation. This issue is fixed in iOS 16.0.3. Processing a maliciously crafted EPSS 0.8%CVE-2024-21625HIGHOne-click remote code execution via malicious deep linkEPSS 0.8%CVE-2023-22465HIGHHttp4s has fatal error parsing User-Agent and Server headersEPSS 0.8%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.8%CVE-2022-40227HIGHA vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP MobEPSS 0.8%CVE-2021-3048MEDIUMPAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall OutageEPSS 0.8%CVE-2025-21344HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 0.8%CVE-2020-15234MEDIUMRedirect URL matching ignores character casingEPSS 0.8%CVE-2017-6794—A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injeEPSS 0.8%CVE-2023-36762HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-38495HIGHCrossplane vulnerable to possible image tampering from missing image validation for PackagesEPSS 0.8%CVE-2021-3802—A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highEPSS 0.8%CVE-2021-37863LOWMattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a cEPSS 0.8%