CWE-20: Improper Input Validation, page 54
Filter
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What the weakness is: CWE-20 at MITRE
Ask an AI about CWE-20
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.8CVE-2024-42410EPSS 0.2%
Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access.
- 6.0CVE-2024-39606EPSS 0.3%
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- 7.1CVE-2024-38307EPSS 0.7%
Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denial of service via network access.
- 5.1CVE-2024-31153EPSS 0.2%
Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable denial of service via local access.
- 8.7CVE-2024-29214EPSS 0.3%
Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 8.7CVE-2024-28127EPSS 0.3%
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 6.8CVE-2024-28047EPSS 0.2%
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
- 4.6CVE-2024-25571EPSS 0.2%
Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via local access.
- 8.7CVE-2024-24582EPSS 0.3%
Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access.
- 8.7CVE-2023-49615EPSS 0.2%
Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
- 8.7CVE-2023-43758EPSS 0.3%
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 8.7CVE-2023-34440EPSS 0.3%
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 5.5CVE-2025-26358EPSS 0.5%
A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests.
- 5.3CVE-2025-1186EPSS 0.7%
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The att…
- 7.5CVE-2024-0112EPSS 0.2%
NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certain permissions to a limited degree. A successful exploit of this vulnerability m…
- 8.2CVE-2024-21925EPSS 0.2%
Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution.
- 8.2CVE-2024-0179EPSS 0.2%
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.
- 7.8CVE-2025-21375EPSS 0.6%
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
- 5.9CVE-2025-21350EPSS 2.1%
Windows Kerberos Denial of Service Vulnerability
- 7.1CVE-2025-21194EPSS 0.8%
Microsoft Surface Security Feature Bypass Vulnerability
- 5.5CVE-2025-21126EPSS 0.3%
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service condition. An attacker could exploit this vulnerability to cause the ap…
- 5.7CVE-2024-33659EPSS 0.2%
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code …
- 7.5CVE-2025-24499EPSS 0.9%
A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCA…
- 5.3CVE-2025-1177EPSS 0.7%
A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The manipulation leads to deserialization. It is possible to la…
- 7.5CVE-2025-24970EPSS 2.2%
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly hand…
- 5.5CVE-2024-55630EPSS 0.3%
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as …
- 5.3CVE-2025-1113EPSS 0.5%
A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The …
- 9.5CVE-2025-1077EPSS 0.9%
A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in spec…
- 7.5CVE-2024-57960EPSS 0.2%
Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.1CVE-2025-24319EPSS 0.4%
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached En…
- 6.8CVE-2024-56135EPSS 0.6%
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) …
- 6.8CVE-2024-56134EPSS 0.6%
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) …
- 6.8CVE-2024-56133EPSS 0.6%
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) …
- 6.8CVE-2024-56132EPSS 6.3%
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) …
- 6.8CVE-2024-56131EPSS 6.1%
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) …
- 7.2CVE-2025-20184EPSS 0.9%
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an aff…
- 5.3CVE-2025-20183EPSS 0.4%
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and dow…
- 6.6CVE-2025-1026EPSS 0.5%
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive f…
- 7.8CVE-2025-1022EPSS 0.5%
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../..…
- 7.8CVE-2024-38420EPSS 0.1%
Memory corruption while configuring a Hypervisor based input virtual device.
- 7.8CVE-2024-38413EPSS 0.1%
Memory corruption while processing frame packets.
- 1.3CVE-2025-0974EPSS 0.4%
A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. …
- 6.3CVE-2025-0938EPSS 1.6%
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifyin…
- 9.8CVE-2024-47857EPSS 0.5%
SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another exi…
- 5.3CVE-2025-24504EPSS 0.2%
An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
- 5.3CVE-2025-24501EPSS 0.3%
An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.
- 6.9CVE-2025-0841EPSS 0.5%
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initi…
- 5.2CVE-2025-24882EPSS 0.2%
regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.
- 5.1CVE-2025-0734EPSS 0.5%
A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiate…
- 5.4CVE-2024-43445EPSS 0.2%
A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated…