CWE-20— Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.— MITRE CWE catalog
14,167 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-20page 14 of 284
- CVE-2021-25437CRITICALCVSS 9.8EG 9.82021-07-08
Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code execution by replacing FOTA update file.
- CVE-2021-25436CRITICALCVSS 9.8EG 9.82021-07-08
Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via Samsung Accessory Protocol.
- CVE-2021-25435CRITICALCVSS 9.8EG 9.82021-07-08
Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using recovery partition in wireless firmware download mode.
- CVE-2021-25434CRITICALCVSS 9.8EG 9.82021-07-08
Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using param partition in wireless firmware download mode.
- CVE-2021-22345CRITICALCVSS 9.8EG 9.82021-06-30
There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause out-of-bounds memory write.
- CVE-2021-34427CRITICALCVSS 9.8EG 9.82021-06-25
In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.
- CVE-2021-27388CRITICALCVSS 9.8EG 9.82021-06-15
SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited confi…
- CVE-2021-22768CRITICALCVSS 9.8EG 9.82021-06-11
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.T…
- CVE-2021-22767CRITICALCVSS 9.8EG 9.82021-06-11
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.T…
- CVE-2021-22765CRITICALCVSS 9.8EG 9.82021-06-11
A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet
- CVE-2021-22911CRITICALCVSS 9.8EG 9.82021-05-27
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
- CVE-2021-29921CRITICALCVSS 9.8EG 9.82021-05-06
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- CVE-2021-1508CRITICALCVSS 9.8EG 9.82021-05-06
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privil…
- CVE-2021-1506CRITICALCVSS 9.8EG 9.82021-05-06
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privil…
- CVE-2021-1505CRITICALCVSS 9.8EG 9.82021-05-06
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privil…
- CVE-2021-1468CRITICALCVSS 9.8EG 9.82021-05-06
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privil…
- CVE-2021-1275CRITICALCVSS 9.8EG 9.82021-05-06
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privil…
- CVE-2020-36195CRITICALCVSS 9.8EG 9.82021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed…
- CVE-2021-1459CRITICALCVSS 9.8EG 9.82021-04-08
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is d…
- CVE-2021-21978CRITICALCVSS 9.8EG 9.82021-03-03
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attack…
- CVE-2020-28870CRITICALCVSS 9.8EG 9.82021-02-10
In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php.
- CVE-2020-14343CRITICALCVSS 9.8EG 9.82021-02-09
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Application…
- CVE-2020-36199CRITICALCVSS 9.8EG 9.82021-01-26
TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.
- CVE-2020-28221CRITICALCVSS 9.8EG 9.82021-01-26
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is ena…
- CVE-2021-1142CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabili…
- CVE-2021-1141CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabili…
- CVE-2021-1140CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabili…
- CVE-2021-1139CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabili…
- CVE-2021-1138CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabili…
- CVE-2021-1301CRITICALCVSS 9.8EG 9.82021-01-20
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
- CVE-2021-3028CRITICALCVSS 9.8EG 9.82021-01-13
git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.
- CVE-2020-0471CRITICALCVSS 9.8EG 9.82021-01-11
In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input validation. This could lead to remote escalation of privilege between two Bluetooth …
- CVE-2016-9026CRITICALCVSS 9.8EG 9.82020-12-31
Exponent CMS before 2.6.0 has improper input validation in fileController.php.
- CVE-2016-9025CRITICALCVSS 9.8EG 9.82020-12-31
Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
- CVE-2016-9023CRITICALCVSS 9.8EG 9.82020-12-31
Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
- CVE-2016-9022CRITICALCVSS 9.8EG 9.82020-12-31
Exponent CMS before 2.6.0 has improper input validation in usersController.php.
- CVE-2016-9021CRITICALCVSS 9.8EG 9.82020-12-31
Exponent CMS before 2.6.0 has improper input validation in storeController.php.
- CVE-2020-28971CRITICALCVSS 9.8EG 9.82020-12-01
An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of ins…
- CVE-2020-13942CRITICALCVSS 9.8EG 9.82020-11-24
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the…
- CVE-2020-28984CRITICALCVSS 9.8EG 9.82020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.
- CVE-2020-3470CRITICALCVSS 9.8EG 9.82020-11-18
Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary …
- CVE-2020-7472CRITICALCVSS 9.8EG 9.82020-11-12
An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a co…
- CVE-2020-28037CRITICALCVSS 9.8EG 9.82020-11-02
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well a…
- CVE-2020-3703CRITICALCVSS 9.8EG 9.82020-11-02
u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow issue (CVE-2019-16336,CVE-2019-17519) a…
- CVE-2019-8531CRITICALCVSS 9.8EG 9.82020-10-27
A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS …
- CVE-2020-27159CRITICALCVSS 9.8EG 9.82020-10-27
Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114
- CVE-2020-25765CRITICALCVSS 9.8EG 9.82020-10-27
Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140.
- CVE-2019-8756CRITICALCVSS 9.8EG 9.82020-10-27
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-0…
- CVE-2019-8749CRITICALCVSS 9.8EG 9.82020-10-27
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-0…
- CVE-2019-17006CRITICALCVSS 9.8EG 9.82020-10-22
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a…
Map vulnerabilities like CWE-20 to your infrastructure
EchelonGraph correlates every CVE — across CWE-20 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →