The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance
An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to exec
An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to
An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a
An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious app
Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Inpu
Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server
An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Image Capture" c
The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximat
Windows Hyper-V in Windows 10 1607, 1703, and Windows Server 2016 allows a denial of service vulnerability when it fails
A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges t
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary co
A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated,
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system fi
A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating syste
A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell acce
A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker t
PRTG Network Monitor 17.3.33.2830 allows remote authenticated administrators to execute arbitrary code by uploading a .e
An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an au
An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a comm
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of servi
Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold,
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incor
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 f
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows re
parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are aff
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are aff
IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSc
Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13
An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" compone
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" compon
NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a mis
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by r
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malf
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issu
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issu
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud b
Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collect
Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by upl
coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined b
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted
Frequently Asked Questions
What is CWE-20?
CWE-20 (Improper Input Validation) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.
How many CVEs are classified as CWE-20?
There are 14,187 CVE records associated with CWE-20 in our database. Of these, 1071 are critical severity, 4031 are high severity, and 3494 are medium severity.
How can I protect against CWE-20 vulnerabilities?
Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-20 using AI-powered security agents.
Detect CWE-20 Vulnerabilities
CyberStrike's AI agents automatically detect improper input validation vulnerabilities across your infrastructure.
Get Started