Falhas do tipo CWE-20

5.888 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2024-3028HIGHImproper Input Validation in mintplex-labs/anything-llmEPSS 0.8%CVE-2020-15192MEDIUMMemory leak in TensorflowEPSS 0.8%CVE-2026-47370CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deEPSS 0.8%CVE-2026-76980HIGHData Exposure vulnerabilityEPSS 0.8%CVE-2023-40053MEDIUMHTML injection Vulnerability in Serv-U 15.4EPSS 0.8%CVE-2021-26613HIGHtobesoft nexacro arbitrary file creation vulnerabilityEPSS 0.8%CVE-2024-42458CRITICALserver.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.EPSS 0.8%CVE-2026-14637HIGHkirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserializationEPSS 0.8%CVE-2022-35773HIGHAzure RTOS GUIX Studio Remote Code Execution VulnerabilityEPSS 0.8%CVE-2017-15093—When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.EPSS 0.8%CVE-2023-25530HIGHNVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploitEPSS 0.8%CVE-2025-2296HIGHUn-verified kernel bypass Secure Boot mechanism in direct boot modeEPSS 0.8%CVE-2026-46454CRITICALApache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersEPSS 0.8%CVE-2025-4563LOWNodes can bypass dynamic resource allocation authorization checksEPSS 0.8%CVE-2024-25583HIGHCrafted responses can lead to a denial of service in Recursor if recursive forwarding is configuredEPSS 0.8%CVE-2026-47367CRITICALA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID EnterpEPSS 0.8%CVE-2024-33700HIGHThe LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackerEPSS 0.8%CVE-2014-125114HIGHi-Ftp 2.20 Schedule.xml Stack-Based Buffer OverflowEPSS 0.8%CVE-2024-38479HIGHApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackEPSS 0.8%CVE-2021-25255HIGHYandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.EPSS 0.8%