cve.bz

CWE-20: Improper Input Validation, page 51

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.6CVE-2025-20034EPSS 0.2%

    Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards before version R01.02.0003 may allow a privileged user to potentially enable information disclosure via loc…

  2. 8.3CVE-2025-20032EPSS 0.2%

    Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to potentially enable denial of service via local access.

  3. 6.8CVE-2025-20031EPSS 0.2%

    Improper input validation for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access.

  4. 5.6CVE-2025-20009EPSS 0.2%

    Improper input validation in the UEFI firmware GenerationSetup module for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to potentially enable information disclosure via local access.

  5. 7.8CVE-2025-32706KEVEPSS 2.3%

    Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  6. 6.5CVE-2025-29968EPSS 2.0%

    Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network.

  7. 5.5CVE-2025-29955EPSS 0.6%

    Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally.

  8. 7.1CVE-2025-40556EPSS 0.3%

    A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versions), BACnet ATEC 550-446 (All versions). Affected devices improperly handle specific incoming BAC…

  9. 7.1CVE-2025-24510EPSS 0.3%

    A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. This could allow an attacker residing in the same BACnet network to send a speciall…

  10. 7.8CVE-2025-31259EPSS 0.2%

    A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to capture a screenshot of an app entering or exiting full screen mode.

  11. 7.5CVE-2025-31240EPSS 0.6%

    This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously crafted AFP network share may lead to system termination.

  12. 6.3CVE-2025-31233EPSS 1.3%

    The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a ma…

  13. 6.5CVE-2025-31217EPSS 0.7%

    The issue was addressed with improved input validation. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may …

  14. 6.5CVE-2025-31215EPSS 0.7%

    The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an…

  15. 7.5CVE-2025-31208EPSS 1.4%

    The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to …

  16. 7.8CVE-2025-30442EPSS 0.2%

    The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to gain elevated privileges.

  17. 7.8CVE-2025-24274EPSS 0.2%

    An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious app may be able to gain root privileges.

  18. 9.3CVE-2025-1087EPSS 1.1%

    Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing tem…

  19. 8.3CVE-2025-4377EPSS 0.8%

    Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.  Logview is accessible on Pr…

  20. 7.1CVE-2025-40846EPSS 0.4%

    Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scri…

  21. 8.2CVE-2025-20197EPSS 0.2%

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. This vulnerability is due t…

  22. 8.6CVE-2025-20154EPSS 0.5%

    A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial…

  23. 7.8CVE-2025-21460EPSS 0.1%

    Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

  24. 7.8CVE-2024-49845EPSS 0.1%

    Memory corruption during the FRS UDS generation process.

  25. 7.8CVE-2024-49844EPSS 0.1%

    Memory corruption while triggering commands in the PlayReady Trusted application.

  26. 7.8CVE-2024-45579EPSS 0.1%

    Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.

  27. 7.8CVE-2024-45577EPSS 0.1%

    Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.

  28. 5.4CVE-2025-46340EPSS 0.3%

    Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker…

  29. 5.3CVE-2025-4260EPSS 0.7%

    A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web\handler\admin\system\TemplateController.java. The manipulation of the argument …

  30. 7.8CVE-2024-13943EPSS 0.2%

    Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first ob…

  31. 7.5CVE-2025-30391EPSS 1.4%

    Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.

  32. 7.3CVE-2025-22235EPSS 0.4%

    EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: …

  33. 5.3CVE-2025-46574EPSS 0.2%

    There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.

  34. 7.5CVE-2025-26413EPSS 0.8%

    Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is  out of …

  35. 6.1CVE-2025-3837EPSS 0.3%

    An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in the customer internal network. This EOL component was deprecated in September 2023…

  36. 7.5CVE-2025-29784EPSS 0.7%

    NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessive…

  37. 6.5CVE-2025-27599EPSS 0.4%

    Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar…

  38. 8.8CVE-2025-26477EPSS 0.4%

    Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

  39. 4.8CVE-2025-3677EPSS 0.2%

    A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserializat…

  40. 5.1CVE-2025-3622EPSS 0.4%

    A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization.

  41. 5.3CVE-2025-3590EPSS 0.4%

    A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. The attack can be launched remotely. The explo…

  42. 6.5CVE-2025-32079EPSS 0.4%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.

  43. 6.9CVE-2025-32077EPSS 0.4%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.

  44. 6.9CVE-2025-32076EPSS 0.4%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

  45. 6.9CVE-2025-32075EPSS 0.4%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

  46. 5.4CVE-2025-32073EPSS 0.2%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43.

  47. 5.4CVE-2025-32071EPSS 0.2%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Ex…

  48. 5.4CVE-2025-32070EPSS 0.2%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43.

  49. 5.4CVE-2025-32069EPSS 0.2%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.

  50. 5.4CVE-2025-32067EPSS 0.2%

    Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43.