Falhas do tipo CWE-20

5.888 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2025-7876MEDIUMMetasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserializationEPSS 0.8%CVE-2024-44809CRITICALA remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. The issue arises from imprEPSS 0.8%CVE-2017-12274—A vulnerability in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series AccesEPSS 0.8%CVE-2020-7867HIGHHelpu arbitrary file creation vulnerabilityEPSS 0.8%CVE-2026-66793HIGHGovernance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spokeEPSS 0.8%CVE-2026-105427MEDIUMImproper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with adminEPSS 0.8%CVE-2020-10622—LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized usersEPSS 0.8%CVE-2023-45193MEDIUMIBM Db2 denial of serviceEPSS 0.8%CVE-2023-47161MEDIUMIBM UrbanCode Deploy denial of serviceEPSS 0.8%CVE-2022-29922HIGHA vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ...EPSS 0.8%CVE-2024-38355HIGHUnhandled 'error' event in socket.ioEPSS 0.8%CVE-2021-31373HIGHJunos OS: SRX Series: Persistent XSS vulnerability in J-WebEPSS 0.8%CVE-2025-64990MEDIUMCommand Injection in 1E-Explorer-TachyonCore-LogoffUser InstructionEPSS 0.8%CVE-2022-27674HIGHInsufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to aEPSS 0.8%CVE-2022-3181HIGHAn Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request coulEPSS 0.8%CVE-2019-12626MEDIUMCisco Unified Contact Center Express Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-31841HIGHAn issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to EPSS 0.8%CVE-2024-24696MEDIUMZoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationEPSS 0.8%CVE-2024-6973HIGHRemote Code Execution in Cato Windows SDP client via crafted URLsEPSS 0.8%CVE-2025-62222HIGHAgentic AI and Visual Studio Code Remote Code Execution VulnerabilityEPSS 0.8%