cve.bz

CWE-20: Improper Input Validation, page 188

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2017-7478ExploitEPSS 14%

    OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

  2. 5.5CVE-2017-8934EPSS 0.3%

    PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability).

  3. 3.3CVE-2017-8933EPSS 0.3%

    Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability).

  4. 10.0CVE-2017-7213EPSS 8.1%

    Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.

  5. 7.8CVE-2016-4838EPSS 1.4%

    The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Ba…

  6. 7.0CVE-2017-0620EPSS 0.7%

    An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requi…

  7. 7.0CVE-2017-0613EPSS 1.6%

    An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High bec…

  8. 5.9CVE-2017-0280EPSS 7.2%

    The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability". This CVE ID is unique from CVE-2017-0269 and CVE-20…

  9. 5.9CVE-2017-0273EPSS 6.1%

    The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability". This CVE ID is unique from CVE-2017-0269 and CVE-20…

  10. 5.9CVE-2017-0269EPSS 6.5%

    The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability". This CVE ID is unique from CVE-2017-0273 and CVE-20…

  11. 5.3CVE-2017-0256EPSS 3.5%

    A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

  12. 7.3CVE-2017-0249EPSS 4.2%

    An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

  13. 7.5CVE-2017-0247EPSS 17%

    A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.E…

  14. 4.3CVE-2017-0231EPSS 3.7%

    A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."

  15. 7.6CVE-2017-0212EPSS 1.1%

    Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 fail to properly validate vSMB packet data, aka "Windows Hyper-V vSMB Elevation of Privilege Vulne…

  16. 5.9CVE-2017-0171EPSS 4.1%

    Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 are configured to answer version queries, aka "Windows DNS Server Denia…

  17. 5.9CVE-2017-5948EPSS 0.8%

    An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or e…

  18. 7.5CVE-2016-7476EPSS 2.4%

    The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak whil…

  19. 4.9CVE-2017-6867EPSS 1.9%

    A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 befor…

  20. 6.5CVE-2017-6865EPSS 0.5%

    A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC Automation Tool (All versions < V3.0), SIMATIC NET PC-Software (All versions < V14 SP1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8…

  21. 5.5CVE-2016-10371EPSS 1.0%

    The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file.

  22. 5.5CVE-2017-0355EPSS 0.3%

    All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where it may access paged memory while holding a spinlock, leading to a denial of service.

  23. 4.7CVE-2017-0354EPSS 0.2%

    All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain function requiring lower IRQL can be made under raised IRQL which may lead to a denial…

  24. 5.5CVE-2017-0353EPSS 0.3%

    All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where due to improper locking on certain conditions may lead to a denial of service

  25. 7.8CVE-2017-0350EPSS 0.4%

    All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of servic…

  26. 7.8CVE-2017-0346EPSS 0.4%

    All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential e…

  27. 7.5CVE-2016-9253EPSS 1.3%

    In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.

  28. 5.3CVE-2016-6877EPSS 1.3%

    Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concl…

  29. 8.6CVE-2016-9692EPSS 1.6%

    IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to …

  30. 7.5CVE-2017-3733EPSS 13%

    During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients a…

  31. 5.8CVE-2017-6620EPSS 1.6%

    A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrec…

  32. 5.3CVE-2017-7428EPSS 1.3%

    NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat.

  33. 9.8CVE-2017-6551EPSS 3.5%

    Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.

  34. 9.8CVE-2016-10243EPSS 7.1%

    TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.

  35. 7.5CVE-2017-8396EPSS 1.8%

    The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of …

  36. 7.8CVE-2017-7721EPSS 1.6%

    IrfanView version 4.44 (32bit) with FPX Plugin before 4.45 has an Access Violation and crash in processing a FlashPix (.FPX) file.

  37. 7.5CVE-2017-7957EPSS 4.9%

    XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromX…

  38. 7.8CVE-2017-2154EPSS 1.2%

    Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST…

  39. 7.5CVE-2017-2153EPSS 1.5%

    SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers to cause a denial of service via specially crafted IPv4 UDP packets.

  40. 6.3CVE-2017-2100EPSS 1.0%

    Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified vectors.

  41. 8.1CVE-2017-8288EPSS 2.9%

    gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see info…

  42. 7.3CVE-2017-3162EPSS 6.4%

    HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

  43. 6.5CVE-2017-8219EPSS 1.2%

    TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI.

  44. 4.3CVE-2017-5041EPSS 1.4%

    Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page.

  45. 5.3CVE-2017-2340EPSS 2.2%

    On Juniper Networks Junos OS 15.1 releases from 15.1R3 to 15.1R4, 16.1 prior to 16.1R3, on M/MX platforms where Enhanced Subscriber Management for DHCPv6 subscribers is configured, a vulnerability in processing IPv6 ND packets originating …

  46. 7.5CVE-2017-2313EPSS 2.3%

    Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process daemon) crash and restart. Repeated crashes of the rpd daemon can result in an ext…

  47. 9.8CVE-2016-3109EPSS 28%

    The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

  48. 9.8CVE-2016-2173EPSS 6.3%

    org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

  49. 4.3CVE-2016-4841EPSS 1.5%

    Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.

  50. 8.8CVE-2017-7220EPSS 2.0%

    OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vu…