CWE-20: Improper Input Validation, page 55

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

1. 5.9CVE-2024-10846EPSS 0.2%2025-01-23

   The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker C…

2. 8.6CVE-2023-50733EPSS 0.4%2025-01-21

   A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.

3. 10.0CVE-2025-23202EPSS 0.4%2025-01-17

   Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the Bible Module are susceptible to injection attacks due to the absence of input val…

4. 5.3CVE-2025-23041EPSS 0.4%2025-01-14

   Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16…

5. 8.8CVE-2025-21370EPSS 0.5%2025-01-14

   Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

6. 7.8CVE-2025-21344EPSS 0.9%2025-01-14

   Microsoft SharePoint Server Remote Code Execution Vulnerability

7. 5.5CVE-2025-21284EPSS 0.7%2025-01-14

   Windows Virtual Trusted Platform Module Denial of Service Vulnerability

8. 5.5CVE-2025-21280EPSS 0.7%2025-01-14

   Windows Virtual Trusted Platform Module Denial of Service Vulnerability

9. 7.8CVE-2025-21235EPSS 0.6%2025-01-14

   Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

10. 7.8CVE-2025-21234EPSS 0.6%2025-01-14

    Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

11. 7.5CVE-2025-21230EPSS 2.7%2025-01-14

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

12. 6.9CVE-2025-0465EPSS 0.9%2025-01-14

    A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserializatio…

13. 4.8CVE-2024-11636EPSS 0.3%2025-01-13

    The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even …

14. 9.8CVE-2024-42175EPSS 0.3%2025-01-11

    HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow.

15. 9.8CVE-2025-22137EPSS 0.6%2025-01-08

    Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, includ…

16. 7.5CVE-2024-54121EPSS 0.2%2025-01-08

    Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

17. 7.5CVE-2024-56437EPSS 0.2%2025-01-08

    Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability.

18. 6.9CVE-2024-47934EPSS 0.5%2025-01-08

    Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by re…

19. 4.4CVE-2024-51741EPSS 0.3%2025-01-06

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem …

20. 5.3CVE-2024-13136EPSS 0.6%2025-01-05

    A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to …

21. 3.8CVE-2024-56321EPSS 0.6%2025-01-03

    GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or con…

22. 7.2CVE-2024-12912EPSS 1.2%2025-01-02

    An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.

23. 5.3CVE-2024-12994EPSS 0.6%2024-12-28

    A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file /import of the component File Upload. The manipulation of the argument file lead…

24. 7.5CVE-2021-22484EPSS 0.3%2024-12-28

    Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause a server out of memory (OOM).

25. 2.0CVE-2024-12014EPSS 0.4%2024-12-20

    Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object …

26. 6.6CVE-2024-21549EPSS 0.6%2024-12-20

    Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which all…

27. 7.5CVE-2022-34159EPSS 0.5%2024-12-20

    Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID: HWPSIRT-2022-80078) This vulnerability has been assigned a Common Vulnerabilit…

28. 7.5CVE-2022-32204EPSS 0.4%2024-12-20

    There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vulnerability ID: HWPSIRT-2022-87185) This vulnerability has been assigned a Commo…

29. 8.6CVE-2022-32144EPSS 0.2%2024-12-20

    There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulnerability ID: HWPSIRT-2022-76192) This vulnerability has been assigned a Common …

30. 8.8CVE-2024-25131EPSS 0.8%2024-12-19

    A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged ser…

31. 5.1CVE-2024-52593EPSS 0.4%2024-12-18

    Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the targ…

32. 6.9CVE-2024-52592EPSS 0.3%2024-12-18

    Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, excep…

33. 8.8CVE-2024-52591EPSS 0.3%2024-12-18

    Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. …

34. 8.8CVE-2024-52590EPSS 0.4%2024-12-18

    Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one wh…

35. 5.4CVE-2024-52579EPSS 0.2%2024-12-18

    Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may re…

36. 8.6CVE-2024-55952EPSS 0.9%2024-12-18

    DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as …

37. 7.0CVE-2020-12487EPSS 0.3%2024-12-17

    Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege.

38. 6.6CVE-2024-21544EPSS 0.6%2024-12-13

    Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before t…

39. 6.7CVE-2024-47238EPSS 0.2%2024-12-12

    Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execut…

40. 5.5CVE-2024-54101EPSS 0.1%2024-12-12

    Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability.

41. 7.5CVE-2024-54100EPSS 0.2%2024-12-12

    Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

42. 4.4CVE-2024-12401EPSS 0.7%2024-12-12

    A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectivel…

43. 4.6CVE-2024-49087EPSS 0.9%2024-12-12

    Windows Mobile Broadband Driver Information Disclosure Vulnerability

44. 6.8CVE-2024-49073EPSS 0.9%2024-12-12

    Windows Mobile Broadband Driver Elevation of Privilege Vulnerability

45. 8.1CVE-2024-49057EPSS 1.7%2024-12-12

    Microsoft Defender for Endpoint on Android Spoofing Vulnerability

46. 9.3CVE-2024-11737EPSS 0.6%2024-12-11

    CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.

47. 2.7CVE-2024-55655EPSS 0.3%2024-12-10

    sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles d…

48. 6.5CVE-2024-55653EPSS 0.6%2024-12-10

    PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The user doesn't need to k…

49. 3.5CVE-2024-52831EPSS 0.9%2024-12-10

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security …

50. 3.5CVE-2024-43755EPSS 0.9%2024-12-10

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security …