Falhas do tipo CWE-20

5.418 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2026-71217HIGHIperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustionEPSS 0.8%CVE-2023-0434MEDIUMImproper Input Validation in pyload/pyloadEPSS 0.8%CVE-2024-27447CRITICALpretix before 2024.1.1 mishandles file validation.EPSS 0.8%CVE-2024-38479HIGHApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackEPSS 0.8%CVE-2022-28755CRITICALImproper URL parsing in Zoom ClientsEPSS 0.8%CVE-2025-48913CRITICALApache CXF: Untrusted JMS configuration can lead to RCEEPSS 0.8%CVE-2026-39399CRITICALNuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment TruncationEPSS 0.8%CVE-2026-48328HIGHColdFusion | Improper Input Validation (CWE-20)EPSS 0.8%CVE-2022-23014—On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed reEPSS 0.8%CVE-2024-43561MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2024-43558MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2024-43557MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2023-28304HIGHMicrosoft ODBC and OLE DB Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-28708MEDIUMOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SEPSS 0.8%CVE-2022-43566HIGHRisky command safeguards bypass via Search ID query in Analytics Workspace in Splunk EnterpriseEPSS 0.8%CVE-2025-27224CRITICALTRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properEPSS 0.8%CVE-2026-20951HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-20255MEDIUMA vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a deniaEPSS 0.8%CVE-2020-15199MEDIUMDenial of Service in TensorflowEPSS 0.8%CVE-2023-40372MEDIUMIBM Db2 denial of serviceEPSS 0.8%