cve.bz

CWE-20: Improper Input Validation, page 78

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 51
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
  • CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-23 File Content Injection Likelihood: High · Severity: Very High
  • CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
  • CAPEC-28 Fuzzing Likelihood: High · Severity: Medium
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-42 MIME Conversion Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
  • CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
  • CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-101 Server Side Include (SSI) Injection Likelihood: High · Severity: High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High
  • CAPEC-153 Input Data Manipulation Severity: Medium
  • CAPEC-182 Flash Injection Likelihood: High · Severity: Medium
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-230 Serialized Data with Nested Payloads Likelihood: Medium · Severity: High
  • CAPEC-231 Oversized Serialized Data Payloads Likelihood: Medium · Severity: High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-473 Signature Spoof
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-20, as MITRE names them. Credits.

Ask an AI about CWE-20

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-34422EPSS 0.5%

    A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.

  2. 6.5CVE-2023-34421EPSS 0.5%

    A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.

  3. 5.2CVE-2023-35163EPSS 0.5%

    Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing pa…

  4. 5.5CVE-2023-25520EPSS 0.2%

    NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can configure invalid settings, resulting in denial of service.

  5. 6.8CVE-2023-32480EPSS 0.3%

    Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability to perform arbitrary code execution.

  6. 6.7CVE-2023-28060EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  7. 6.7CVE-2023-28058EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  8. 6.7CVE-2023-28050EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  9. 6.7CVE-2023-28044EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  10. 6.7CVE-2023-28036EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  11. 6.7CVE-2023-28034EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  12. 6.7CVE-2023-28031EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  13. 6.7CVE-2023-28027EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  14. 6.7CVE-2023-28026EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  15. 6.7CVE-2023-25938EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  16. 6.7CVE-2023-28061EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  17. 6.7CVE-2023-28059EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  18. 6.7CVE-2023-28056EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  19. 6.7CVE-2023-28054EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  20. 6.7CVE-2023-28052EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  21. 6.7CVE-2023-28042EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  22. 6.7CVE-2023-28041EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  23. 6.7CVE-2023-28040EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  24. 6.7CVE-2023-28039EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  25. 6.7CVE-2023-28035EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  26. 6.7CVE-2023-28033EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  27. 6.7CVE-2023-28032EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  28. 6.7CVE-2023-28030EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  29. 6.7CVE-2023-28029EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable

  30. 6.7CVE-2023-28028EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  31. 6.7CVE-2023-25937EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  32. 6.7CVE-2023-25936EPSS 0.2%

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.

  33. 7.5CVE-2023-32463EPSS 0.5%

    Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system …

  34. 7.5CVE-2023-0026EPSS 0.6%

    An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update messa…

  35. 2.7CVE-2023-29293EPSS 1.0%

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could le…

  36. 5.5CVE-2023-21143EPSS 0.08%

    In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is n…

  37. 7.8CVE-2023-21138EPSS 0.08%

    In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges…

  38. 5.5CVE-2023-21136EPSS 0.1%

    In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is no…

  39. 7.8CVE-2023-21135EPSS 0.09%

    In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed…

  40. 7.8CVE-2023-21121EPSS 0.08%

    In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to improper input validation. This could lead to local escalation of privilege with no additional execution …

  41. 7.2CVE-2023-34448EPSS 4.5%

    Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions …

  42. 7.5CVE-2023-30631EPSS 2.0%

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow c…

  43. 6.5CVE-2023-24937EPSS 2.1%

    Windows CryptoAPI Denial of Service Vulnerability

  44. 6.5CVE-2023-32032EPSS 0.6%

    .NET and Visual Studio Elevation of Privilege Vulnerability

  45. 9.8CVE-2023-32015EPSS 2.0%

    Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

  46. 7.8CVE-2023-29371EPSS 5.4%

    Windows GDI Elevation of Privilege Vulnerability

  47. 7.8CVE-2023-29359EPSS 0.5%

    GDI Elevation of Privilege Vulnerability

  48. 5.5CVE-2023-29353EPSS 0.8%

    Sysinternals Process Monitor for Windows Denial of Service Vulnerability

  49. 5.4CVE-2023-2455EPSS 0.7%

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed u…

  50. 7.2CVE-2023-2454EPSS 1.2%

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.