cve.bz

CWE-20: Improper Input Validation, page 63

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2021-22508EPSS 0.4%

    A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries. An attack requires to be an authenticated administrator of OBR with network acce…

  2. 6.7CVE-2024-22429EPSS 0.2%

    Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution.

  3. 8.8CVE-2024-22120EPSS 77%

    Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time …

  4. 7.5CVE-2024-24981EPSS 0.2%

    Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged user to enable escalation of privilege via local access.

  5. 7.5CVE-2024-23487EPSS 0.2%

    Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.

  6. 10.0CVE-2024-22476ExploitEPSS 36%

    Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.

  7. 4.4CVE-2024-22390EPSS 0.2%

    Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.

  8. 7.5CVE-2024-22382EPSS 0.2%

    Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.

  9. 7.2CVE-2024-22095EPSS 0.2%

    Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.

  10. 6.5CVE-2024-22015EPSS 0.2%

    Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local access.

  11. 5.5CVE-2023-48368EPSS 0.2%

    Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.

  12. 6.7CVE-2023-47855EPSS 0.4%

    Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.

  13. 4.7CVE-2023-47210EPSS 0.4%

    Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  14. 8.2CVE-2023-45745EPSS 0.4%

    Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.

  15. 2.8CVE-2023-43745EPSS 0.2%

    Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of service via local access.

  16. 8.2CVE-2023-38654EPSS 0.3%

    Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  17. 4.3CVE-2023-38417EPSS 0.4%

    Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

  18. 7.2CVE-2023-28402EPSS 0.2%

    Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access.

  19. 5.8CVE-2023-22662EPSS 0.2%

    Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user to potentially enable denial of service via local access.

  20. 8.8CVE-2024-4609EPSS 0.7%

    A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials wer…

  21. 7.5CVE-2024-4321EPSS 0.6%

    A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file…

  22. 7.1CVE-2024-25743EPSS 0.2%

    In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. This affects AMD SEV-SNP and AMD SEV-ES.

  23. 5.5CVE-2024-20394EPSS 0.1%

    A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to the inability to handle unexpe…

  24. 9.8CVE-2024-3968EPSS 0.7%

    Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task.

  25. 9.8CVE-2024-3488EPSS 0.4%

    File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.

  26. 6.4CVE-2024-2248EPSS 0.3%

    A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user …

  27. 7.8CVE-2024-34098EPSS 0.4%

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires…

  28. 7.2CVE-2021-22280EPSS 0.2%

    Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of the product.

  29. 7.5CVE-2024-3676EPSS 0.4%

    The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption…

  30. 6.5CVE-2024-30054EPSS 1.7%

    Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability

  31. 8.8CVE-2024-30040KEVEPSS 3.9%

    Windows MSHTML Platform Security Feature Bypass Vulnerability

  32. 6.8CVE-2024-30002EPSS 0.9%

    Windows Mobile Broadband Driver Remote Code Execution Vulnerability

  33. 6.8CVE-2024-29998EPSS 0.9%

    Windows Mobile Broadband Driver Remote Code Execution Vulnerability

  34. 7.5CVE-2024-3372EPSS 0.5%

    Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus response…

  35. 6.5CVE-2024-25970EPSS 0.7%

    Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity.

  36. 9.1CVE-2024-34365EPSS 1.2%Unsupported when assigned

    Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alt…

  37. 7.5CVE-2024-32992EPSS 0.5%

    Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability.

  38. 7.5CVE-2024-32990EPSS 0.4%

    Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.

  39. 7.5CVE-2024-32989EPSS 0.4%

    Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.

  40. 5.3CVE-2024-32672EPSS 0.8%

    A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted input. This issue affects Escargot: 4.0.0.

  41. 5.3CVE-2024-32669EPSS 0.6%

    Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0.

  42. 7.5CVE-2024-30258EPSS 0.8%

    FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed `RTPS` packet, the subscriber cr…

  43. 9.1CVE-2024-2257EPSS 1.0%

    This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to improper implementation of password policies. An attacker with physical access could exploit this by creating password that …

  44. 7.2CVE-2024-25641ExploitEPSS 86%

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templa…

  45. 7.5CVE-2024-25581EPSS 1.1%

    When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXF…

  46. 8.8CVE-2024-2746EPSS 0.2%

    Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a u…

  47. 8.4CVE-2024-1929EPSS 0.3%

    Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit…

  48. 7.8CVE-2024-23707EPSS 0.10%

    In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

  49. 7.8CVE-2024-23706EPSS 0.1%

    In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need…

  50. 7.8CVE-2024-23705EPSS 0.3%

    In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …