CWE-20— Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.— MITRE CWE catalog
14,117 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-20page 2 of 283
- CVE-2024-38189CRITICALCVSS 8.8EG 9.0⚠ KEV2024-08-13
Microsoft Project Remote Code Execution Vulnerability
- CVE-2024-30040CRITICALCVSS 8.8EG 9.0⚠ KEV2024-05-14
Windows MSHTML Platform Security Feature Bypass Vulnerability
- CVE-2023-22952CRITICALCVSS 8.8EG 9.0⚠ KEV2023-01-11
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
- CVE-2021-36741CRITICALCVSS 8.8EG 9.0⚠ KEV2021-07-29
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: …
- CVE-2020-1020CRITICALCVSS 8.8EG 9.0⚠ KEV2020-04-15
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an a…
- CVE-2020-0618CRITICALCVSS 8.8EG 9.0⚠ KEV2020-02-11
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
- CVE-2019-1068CRITICALCVSS 8.8EG 9.0⚠ KEV2019-07-15
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
- CVE-2018-8414CRITICALCVSS 8.8EG 9.0⚠ KEV2018-08-15
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
- CVE-2017-6327CRITICALCVSS 8.8EG 9.0⚠ KEV2017-08-11
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target proc…
- CVE-2017-0146CRITICALCVSS 8.8EG 9.0⚠ KEV2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
- CVE-2017-0145CRITICALCVSS 8.8EG 9.0⚠ KEV2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
- CVE-2017-0144CRITICALCVSS 8.8EG 9.0⚠ KEV2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
- CVE-2017-0143CRITICALCVSS 8.8EG 9.0⚠ KEV2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
- CVE-2016-0034CRITICALCVSS 8.8EG 9.0⚠ KEV2016-01-13
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverligh…
- CVE-2013-3900CRITICALCVSS 8.8EG 9.0⚠ KEV2013-12-11
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently suppor…
- CVE-2013-6282CRITICALCVSS 8.8EG 9.0⚠ KEV2013-11-20
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations …
- CVE-2010-1871CRITICALCVSS 8.8EG 9.0⚠ KEV2010-08-05
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code…
- CVE-2009-0927CRITICALCVSS 8.8EG 9.0⚠ KEV2009-03-19
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different …
- CVE-2018-0174CRITICALCVSS 8.6EG 9.0⚠ KEV2018-03-28
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS)…
- CVE-2018-0173CRITICALCVSS 8.6EG 9.0⚠ KEV2018-03-28
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to…
- CVE-2018-0172CRITICALCVSS 8.6EG 9.0⚠ KEV2018-03-28
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS)…
- CVE-2018-0158CRITICALCVSS 8.6EG 9.0⚠ KEV2018-03-28
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a …
- CVE-2016-3714CRITICALCVSS 8.4EG 9.0⚠ KEV2016-05-05
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted im…
- CVE-2017-17562CRITICALCVSS 8.1EG 9.0⚠ KEV2017-12-12
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cg…
- CVE-2017-0148CRITICALCVSS 8.1EG 9.0⚠ KEV2017-03-17
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote at…
- CVE-2025-32706CRITICALCVSS 7.8EG 9.0⚠ KEV2025-05-13
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- CVE-2023-41061CRITICALCVSS 7.8EG 9.0⚠ KEV2023-09-07
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue m…
- CVE-2021-30713CRITICALCVSS 7.8EG 9.0⚠ KEV2021-09-08
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exp…
- CVE-2021-36742CRITICALCVSS 7.8EG 9.0⚠ KEV2021-07-29
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an att…
- CVE-2020-11261CRITICALCVSS 7.8EG 9.0⚠ KEV2021-06-09
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sn…
- CVE-2021-1647CRITICALCVSS 7.8EG 9.0⚠ KEV2021-01-12
Microsoft Defender Remote Code Execution Vulnerability
- CVE-2020-27930CRITICALCVSS 7.8EG 9.0⚠ KEV2020-12-08
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 an…
- CVE-2020-0938CRITICALCVSS 7.8EG 9.0⚠ KEV2020-04-15
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an a…
- CVE-2020-0041CRITICALCVSS 7.8EG 9.0⚠ KEV2020-03-10
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo…
- CVE-2017-8759CRITICALCVSS 7.8EG 9.0⚠ KEV2017-09-13
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
- CVE-2015-2291CRITICALCVSS 7.8EG 9.0⚠ KEV2017-08-09
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a…
- CVE-2016-7262CRITICALCVSS 7.8EG 9.0⚠ KEV2016-12-20
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandl…
- CVE-2016-0185CRITICALCVSS 7.8EG 9.0⚠ KEV2016-05-11
Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."
- CVE-2015-2545CRITICALCVSS 7.8EG 9.0⚠ KEV2015-09-09
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
- CVE-2014-4114CRITICALCVSS 7.8EG 9.0⚠ KEV2014-10-15
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object …
- CVE-2013-5065CRITICALCVSS 7.8EG 9.0⚠ KEV2013-11-28
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
- CVE-2012-1535CRITICALCVSS 7.8EG 9.0⚠ KEV2012-08-15
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF…
- CVE-2012-0151CRITICALCVSS 7.8EG 9.0⚠ KEV2012-04-10
The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not prop…
- CVE-2010-3904CRITICALCVSS 7.8EG 9.0⚠ KEV2010-12-06
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to g…
- CVE-2010-2568CRITICALCVSS 7.8EG 9.0⚠ KEV2010-07-22
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which i…
- CVE-2009-1123CRITICALCVSS 7.8EG 9.0⚠ KEV2009-06-10
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a cr…
- CVE-2021-42278CRITICALCVSS 7.5EG 9.0⚠ KEV2021-11-10
Active Directory Domain Services Elevation of Privilege Vulnerability
- CVE-2020-3452CRITICALCVSS 7.5EG 9.0⚠ KEV2020-07-22
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and …
- CVE-2018-0296CRITICALCVSS 7.5EG 9.0⚠ KEV2018-06-07
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is…
- CVE-2018-0159CRITICALCVSS 7.5EG 9.0⚠ KEV2018-03-28
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting…
Map vulnerabilities like CWE-20 to your infrastructure
EchelonGraph correlates every CVE — across CWE-20 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →