cve.bz

CWE-20: Improper Input Validation, page 110

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2021-27643EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  2. 5.5CVE-2021-27642EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  3. 5.5CVE-2021-27641EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  4. 5.5CVE-2021-27640EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicat…

  5. 5.5CVE-2021-27639EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicati…

  6. 5.5CVE-2021-27638EPSS 0.6%

    SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the applicati…

  7. 7.8CVE-2020-11261KEVEPSS 1.5%

    Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sn…

  8. 7.8CVE-2020-11178EPSS 0.2%

    Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping with its memory and its RoT memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT…

  9. 5.3CVE-2020-26138EPSS 1.3%

    In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.

  10. 7.5CVE-2021-22116EPSS 1.4%

    RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages…

  11. 7.8CVE-2021-3490ExploitEPSS 27%

    The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code executi…

  12. 6.5CVE-2021-32666EPSS 0.9%

    wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial of service between users. If a user has an invalid assetID for their profile pic…

  13. 6.3CVE-2021-32635EPSS 1.4%

    Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt t…

  14. 6.5CVE-2021-29507EPSS 0.7%

    GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the appl…

  15. 9.4CVE-2021-32642EPSS 1.3%

    radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` and `radsec-dynsrv.sh` scripts can lead to configuration injection via crafted ra…

  16. 7.5CVE-2021-29629EPSS 1.2%

    In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10, missing message validation in libradius(3) could allow…

  17. 6.5CVE-2021-33620EPSS 80%

    Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any…

  18. 9.6CVE-2021-20195EPSS 1.2%

    A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to pro…

  19. 9.0CVE-2020-15180EPSS 5.5%

    A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This …

  20. 7.5CVE-2021-22359EPSS 0.7%

    There is a denial of service vulnerability in the verisions V200R005C00SPC500 of S5700 and V200R005C00SPC500 of S6700. An attacker could exploit this vulnerability by sending specific message to a targeted device. Due to insufficient input…

  21. 4.3CVE-2021-22358EPSS 0.5%

    There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the ser…

  22. 5.5CVE-2021-30501EPSS 1.0%

    An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

  23. 5.3CVE-2021-28170EPSS 2.1%

    In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

  24. 5.5CVE-2021-20297EPSS 0.3%

    A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.

  25. 7.5CVE-2021-22699EPSS 1.0%

    Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP.

  26. 9.8CVE-2021-21985KEVExploitEPSS >99.9%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port …

  27. 5.5CVE-2020-13602EPSS 0.3%

    Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835). For more information, see https://github.c…

  28. 7.5CVE-2020-36332EPSS 2.0%

    A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability.

  29. 5.3CVE-2021-3531EPSS 2.2%

    A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to t…

  30. 6.5CVE-2021-3524EPSS 1.6%

    A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag…

  31. 7.1CVE-2020-27833EPSS 1.7%

    A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to …

  32. 5.5CVE-2021-29611EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87…

  33. 2.4CVE-2020-4811EPSS 0.7%

    IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation.

  34. 6.8CVE-2021-23906EPSS 0.8%

    An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution.

  35. 7.8CVE-2020-27823EPSS 1.1%

    A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as sys…

  36. 6.5CVE-2020-25713EPSS 2.1%

    A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.

  37. 5.5CVE-2020-27824EPSS 1.6%

    A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerabil…

  38. 5.3CVE-2020-12526EPSS 1.0%

    TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically cr…

  39. 5.5CVE-2021-22152EPSS 0.2%

    A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any …

  40. 5.3CVE-2020-26146EPSS 5.6%

    An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerab…

  41. 6.5CVE-2020-26145EPSS 3.5%

    An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An a…

  42. 6.5CVE-2020-26144EPSS 4.9%

    An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An …

  43. 6.5CVE-2020-26143EPSS 4.2%

    An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary…

  44. 7.8CVE-2021-31198EPSS 4.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  45. 4.9CVE-2021-27617EPSS 0.8%

    The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when u…

  46. 7.8CVE-2021-32471EPSS 0.8%

    Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via crafted data. For example, a tape head may have an unexpected location after the proc…

  47. 7.5CVE-2020-11268EPSS 0.7%

    Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile

  48. 5.5CVE-2021-1519EPSS 0.2%

    A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to i…

  49. 7.8CVE-2021-1514EPSS 0.3%

    A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator privileges on the underlying operating system. This vulnerability is due to ins…

  50. 7.5CVE-2021-1513EPSS 1.5%

    A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient handli…