cve.bz

CWE-20: Improper Input Validation, page 146

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2019-1785EPSS 1.8%

    A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulne…

  2. 9.8CVE-2014-9186EPSS 3.6%

    A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential inform…

  3. 7.8CVE-2018-11966EPSS 0.2%

    Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640,…

  4. 7.8CVE-2018-11830EPSS 0.2%

    Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU,…

  5. 7.5CVE-2015-5606EPSS 1.7%

    Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.

  6. 5.5CVE-2018-4462EPSS 0.7%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2.

  7. 6.5CVE-2018-4460EPSS 1.5%

    A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.

  8. 3.3CVE-2018-4446EPSS 0.6%

    This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.1.1.

  9. 4.3CVE-2018-4440EPSS 1.6%

    A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.

  10. 6.5CVE-2018-4439EPSS 1.9%

    A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.

  11. 7.8CVE-2018-4435ExploitEPSS 3.1%

    A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.

  12. 6.5CVE-2018-4429EPSS 0.8%

    A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, watchOS 5.1.2.

  13. 7.8CVE-2018-4423EPSS 0.9%

    A logic issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.1.

  14. 5.5CVE-2018-4418EPSS 0.8%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.

  15. 5.5CVE-2018-4417EPSS 0.8%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.

  16. 6.5CVE-2018-4406EPSS 1.1%

    A denial of service issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.

  17. 5.5CVE-2018-4400EPSS 0.9%

    A validation issue was addressed with improved logic. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, watchOS 5.1.

  18. 5.5CVE-2018-4399EPSS 0.9%

    An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

  19. 7.5CVE-2018-4398EPSS 1.6%

    An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1, iTunes …

  20. 4.3CVE-2018-4397EPSS 0.8%

    Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Support 2.4 for iOS.

  21. 5.5CVE-2018-4396EPSS 0.8%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.

  22. 5.5CVE-2018-4395EPSS 0.3%

    This issue was addressed with improved checks. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

  23. 6.5CVE-2018-4389EPSS 1.0%

    An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to macOS Mojave 10.14.1.

  24. 6.5CVE-2018-4385EPSS 1.0%

    A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.

  25. 7.5CVE-2018-4369EPSS 1.5%

    A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1.

  26. 6.5CVE-2018-4368EPSS 1.6%

    A denial of service issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1.

  27. 5.5CVE-2018-4363EPSS 1.0%

    An input validation issue existed in the kernel. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5.

  28. 6.5CVE-2018-4362EPSS 1.0%

    An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2, iOS 12.

  29. 9.8CVE-2018-4353EPSS 1.3%

    A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS Mojave 10.14.

  30. 5.5CVE-2018-4348EPSS 0.3%

    A validation issue was addressed with improved logic. This issue affected versions prior to macOS Mojave 10.14.

  31. 5.5CVE-2018-4346EPSS 0.8%

    A validation issue existed which allowed local file access. This was addressed with input sanitization. This issue affected versions prior to macOS Mojave 10.14.

  32. 5.5CVE-2018-4342EPSS 0.3%

    A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS Mojave 10.14.1.

  33. 5.5CVE-2018-4338EPSS 1.4%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.

  34. 5.5CVE-2018-4335EPSS 0.8%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to iOS 12.

  35. 5.5CVE-2018-4333EPSS 0.8%

    A validation issue was addressed with improved input sanitization. This issue affected versions prior to iOS 12, macOS Mojave 10.14.

  36. 3.3CVE-2018-4322EPSS 0.3%

    This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.

  37. 5.3CVE-2018-4321EPSS 1.3%

    A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12.

  38. 5.5CVE-2018-4313EPSS 0.3%

    A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of message deletions. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5.

  39. 4.3CVE-2018-4307EPSS 1.1%

    A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12, Safari 12.

  40. 6.5CVE-2018-4305EPSS 0.5%

    An input validation issue was addressed with improved input validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5.

  41. 5.0CVE-2018-4304EPSS 0.9%

    A denial of service issue was addressed with improved validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

  42. 7.8CVE-2018-4303EPSS 0.9%

    An input validation issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14, iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.

  43. 9.8CVE-2018-4295EPSS 1.4%

    An input validation issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.

  44. 5.3CVE-2018-4293EPSS 1.3%

    A cookie management issue was addressed with improved checks. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.

  45. 5.3CVE-2018-4279EPSS 0.8%

    An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2.

  46. 7.5CVE-2018-4274EPSS 0.8%

    A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, Safari 11.1.2.

  47. 6.5CVE-2018-4260EPSS 0.8%

    An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to iOS 11.4.1, Safari 11.1.2.

  48. 6.5CVE-2018-4195EPSS 1.0%

    An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 12.

  49. 7.8CVE-2017-13911EPSS 0.9%

    A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS X El Capitan 10.11.6 Security Update 2018-002, macOS Sierra 10.12.6 Security Update 2018-002, macOS High Sierra 10.13.2.

  50. 5.5CVE-2018-4053EPSS 0.3%

    An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can send malicious data to the root-listening service, causing the application to termin…