cve.bz

CWE-20: Improper Input Validation, page 183

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2017-2254EPSS 1.1%

    Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input

  2. 7.5CVE-2015-0234EPSS 1.3%

    Multiple temporary file creation vulnerabilities in pki-core 10.2.0.

  3. 7.5CVE-2015-1554EPSS 1.5%

    kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).

  4. 8.8CVE-2015-1443EPSS 3.5%

    The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.

  5. 7.5CVE-2017-13709EPSS 1.1%

    In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.

  6. 7.8CVE-2017-12595EPSS 1.8%

    The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF docu…

  7. 7.5CVE-2017-13692EPSS 1.1%

    In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNUM argument.

  8. 5.3CVE-2015-5146EPSS 4.9%

    ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (se…

  9. 8.8CVE-2017-13147EPSS 1.5%

    In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.

  10. 6.5CVE-2017-13145EPSS 1.6%

    In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.

  11. 6.5CVE-2017-13144EPSS 2.0%

    In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

  12. 6.5CVE-2017-12843EPSS 1.2%

    Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.

  13. 6.5CVE-2017-13061EPSS 1.5%

    In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.

  14. 7.5CVE-2017-12784EPSS 2.3%

    In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malformed request heade…

  15. 8.8CVE-2017-12976EPSS 3.1%

    git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12…

  16. 7.5CVE-2017-12961EPSS 1.3%

    There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

  17. 7.8CVE-2017-8260EPSS 0.6%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validation and cause an out of bounds write later.

  18. 9.8CVE-2016-5872EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validated.

  19. 9.8CVE-2016-10391EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity.

  20. 9.8CVE-2016-10387EPSS 1.0%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a handover scenario.

  21. 9.8CVE-2016-10384EPSS 1.0%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a WLAN driver ioctl.

  22. 9.8CVE-2016-10347EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a hypervisor function is not properly validated.

  23. 9.8CVE-2015-9069EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.

  24. 9.8CVE-2015-9068EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.

  25. 9.8CVE-2015-9061EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.

  26. 9.8CVE-2015-9060EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call.

  27. 9.8CVE-2015-9055EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a memory management routine.

  28. 9.8CVE-2015-9052EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.

  29. 9.8CVE-2015-9051EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.

  30. 9.8CVE-2015-9049EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.

  31. 9.8CVE-2015-9048EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packets.

  32. 9.8CVE-2015-9046EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.

  33. 9.8CVE-2015-9044EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.

  34. 9.8CVE-2015-9039EPSS 0.9%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.

  35. 9.8CVE-2015-0574EPSS 1.0%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient.

  36. 9.8CVE-2014-9971EPSS 1.0%

    In all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow.

  37. 5.9CVE-2017-12859EPSS 1.8%

    NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors.

  38. 7.8CVE-2015-3649EPSS 0.4%

    The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.

  39. 9.8CVE-2017-12939EPSS 4.7%

    A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, e.g., before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.

  40. 4.3CVE-2017-6785EPSS 1.6%

    A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal privilege escalation where one user can modify another user…

  41. 6.7CVE-2017-6773EPSS 0.4%

    A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local attacker to bypass the CLI restrictions and execute commands on the underlying op…

  42. 8.8CVE-2017-12426EPSS 3.5%

    GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via …

  43. 9.8CVE-2017-9800EPSS 19%

    A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a mali…

  44. 8.2CVE-2017-3752EPSS 0.4%

    An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to…

  45. 5.5CVE-2017-0724EPSS 0.3%

    A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36819262.

  46. 7.8CVE-2017-0721EPSS 1.3%

    A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37561455.

  47. 7.8CVE-2017-0712EPSS 0.4%

    A elevation of privilege vulnerability in the Android framework (wi-fi service). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37207928.

  48. 4.3CVE-2017-1357EPSS 0.9%

    IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684.

  49. 7.8CVE-2015-2291KEVExploitEPSS 16%

    (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a…

  50. 4.6CVE-2017-5695EPSS 0.3%

    Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P…