cve.bz

CWE-20: Improper Input Validation, page 44

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.7CVE-2025-24847EPSS 0.3%

    Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low co…

  2. 5.7CVE-2025-24512EPSS 0.1%

    Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Authorized adversary with an authenticated user combined with a high c…

  3. 8.7CVE-2025-24299EPSS 0.3%

    Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a l…

  4. 4.8CVE-2025-20056EPSS 0.1%

    Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity …

  5. 6.8CVE-2025-12944EPSS 0.3%

    Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially execute code on the device. Please check the firmware version and update to the la…

  6. 4.8CVE-2025-12942EPSS 0.3%

    Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R…

  7. 6.5CVE-2025-63397EPSS 0.4%

    Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion.

  8. 5.4CVE-2025-12908EPSS 0.2%

    Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

  9. 8.8CVE-2025-12907EPSS 0.3%

    Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)

  10. 6.1CVE-2025-63785EPSS 0.3%

    A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected int…

  11. 7.6CVE-2025-63783EPSS 0.3%

    A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the o…

  12. 5.3CVE-2025-48985EPSS 0.3%

    A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:…

  13. 6.1CVE-2025-64176EPSS 0.3%

    ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. Wh…

  14. 7.1CVE-2025-61084EPSS 0.2%

    MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoof…

  15. 6.0CVE-2025-59596EPSS 0.2%

    CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local networking policy is active, attackers on an adjacent network may be able to send …

  16. 8.2CVE-2025-59595EPSS 0.4%

    CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially crafted packet to a server in a non-default configuration and cause the server to c…

  17. 7.7CVE-2025-62507EPSS 7.5%

    Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution.…

  18. 6.5CVE-2025-54327EPSS 0.2%

    An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the VTS driver leads to an arbitrary write.

  19. 7.8CVE-2025-43472EPSS 0.2%

    A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to gain root privileges.

  20. 4.3CVE-2025-43458EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafte…

  21. 4.3CVE-2025-43430EPSS 1.1%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an u…

  22. 4.3CVE-2025-43427EPSS 0.5%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected proc…

  23. 7.5CVE-2025-43401EPSS 1.0%

    A denial-of-service issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A remote attacker may be able to cause a denial-of-service.

  24. 2.8CVE-2025-43365EPSS 0.1%

    A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivileged process may be able to terminate a root processes.

  25. 5.5CVE-2025-43348EPSS 0.2%

    A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may bypass Gatekeeper checks.

  26. 9.2CVE-2025-64385EPSS 0.4%

    The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this commun…

  27. 9.1CVE-2025-61235EPSS 0.4%

    An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields can contain arbitrary or trivial data. Normally, such data should cause the device to reject the pac…

  28. 2.1CVE-2025-12305EPSS 0.5%

    A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserializatio…

  29. 9.8CVE-2025-27224EPSS 0.9%

    TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included…

  30. 10.0CVE-2025-12285EPSS 0.3%

    Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  31. 6.9CVE-2025-12284EPSS 0.2%

    Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  32. 6.9CVE-2025-12278EPSS 0.2%

    Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  33. 10.0CVE-2025-12275EPSS 0.5%

    Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  34. 4.3CVE-2025-11497EPSS 0.2%

    The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() functi…

  35. 7.5CVE-2025-60938EPSS 0.6%

    Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-…

  36. 5.1CVE-2025-11958EPSS 0.4%

    An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.

  37. 8.8CVE-2025-62525EPSS 0.2%

    OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DS…

  38. 10.0CVE-2025-12001EPSS 0.2%

    Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  39. 7.5CVE-2025-26781EPSS 0.6%

    An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads …

  40. 2.9CVE-2025-11938EPSS 0.7%

    A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may…

  41. 9.4CVE-2025-8414EPSS 0.3%

    Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Ac…

  42. 6.5CVE-2025-60537EPSS 0.5%

    Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data.

  43. 8.1CVE-2025-59250EPSS 0.7%

    Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

  44. 7.5CVE-2025-59248EPSS 1.0%

    Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  45. 8.8CVE-2025-59228EPSS 1.4%

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  46. 7.8CVE-2025-59207EPSS 0.4%

    Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

  47. 5.0CVE-2025-59198EPSS 0.5%

    Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

  48. 5.5CVE-2025-59190EPSS 0.5%

    Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.

  49. 7.8CVE-2025-59187EPSS 0.3%

    Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.

  50. 8.8CVE-2025-58716EPSS 0.4%

    Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.