Falhas do tipo CWE-20

5.888 resultados

Validação inadequada de entrada

A aplicação recebe dados do usuário ou de fontes externas mas não valida (ou valida mal) se esses dados têm as propriedades necessárias para processamento seguro. Isso abre porta para injeção de código, buffer overflow, lógica corrompida e outros ataques que exploram dados malformados ou maliciosos.

Exemplo

Um formulário web aceita um CPF sem verificar se tem 11 dígitos numéricos, ou um app móvel recebe um ID de usuário em JSON sem confirmar se é um inteiro — atacantes exploram isso para acessar dados de outros usuários, executar queries SQL maliciosas ou causar erro de processamento.

Como mitigar

Implemente validação rigorosa na entrada: verifique tipo, comprimento, formato, intervalo de valores permitidos. Use whitelist (aceitar só o que você sabe ser seguro) em vez de blacklist. Valide tanto no cliente quanto no servidor, e use bibliotecas de parsing seguro para formatos complexos (XML, JSON).

CVE-2023-5397HIGHServer receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failEPSS 0.8%CVE-2022-23831HIGHInsufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential WindEPSS 0.8%CVE-2019-19164HIGHDext5 Upload ActiveX Arbitrary File Execution VulnerabilityEPSS 0.8%CVE-2024-29946HIGHRisky command safeguards bypass in Dashboard Examples HubEPSS 0.8%CVE-2021-42122MEDIUMDenial of Service via Invalid Object Attribute in TopEaseEPSS 0.8%CVE-2021-33141HIGHImproper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unautEPSS 0.8%CVE-2023-5104MEDIUMImproper Input Validation in nocodb/nocodbEPSS 0.8%CVE-2021-38455HIGHAUVESY VersiondogEPSS 0.8%CVE-2023-29353MEDIUMSysinternals Process Monitor for Windows Denial of Service VulnerabilityEPSS 0.8%CVE-2022-22726—A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users thEPSS 0.8%CVE-2023-5079HIGHLenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resulEPSS 0.8%CVE-2023-47355HIGHThe com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for EPSS 0.8%CVE-2026-11736LOWStack-based buffer overflow vulnerability in some NETGEAR Nighthawk routersEPSS 0.8%CVE-2024-41976HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.8%CVE-2024-38879HIGHA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), OmniviEPSS 0.8%CVE-2018-12448—Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-htEPSS 0.8%CVE-2026-35031CRITICALJellyfin: Potential RCE via subtitle upload path traversal + .strm chainEPSS 0.8%CVE-2026-35433HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-46929HIGHAn issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:EPSS 0.8%CVE-2025-26413HIGHApache Kvrocks: The server was crashed by the negative offsetEPSS 0.8%