28
Observed Examples
Reference Description
CVE-2022-45918 Chain: a learning management tool debugger uses external input to locate
previous session logs (CWE-73) and does not properly validate the given
path (CWE-20), allowing for filesystem path traversal using "../" sequences
(CWE-24)
https://www.cve.org/CVERecord?id=CVE-2022-45918
CVE-2021-30860 Chain: improper input validation (CWE-20) leads to integer overflow
(CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-30860
CVE-2021-30663 Chain: improper input validation (CWE-20) leads to integer overflow
(CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-30663
CVE-2021-22205 Chain: backslash followed by a newline can bypass a validation step
(CWE-20), leading to eval injection (CWE-95), as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-22205
CVE-2021-21220 Chain: insufficient input validation (CWE-20) in browser allows heap corruption
(CWE-787), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21220
CVE-2020-9054 Chain: improper input validation (CWE-20) in username parameter, leading to
OS command injection (CWE-78), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-9054
CVE-2020-3452 Chain: security product has improper input validation (CWE-20) leading to
directory traversal (CWE-22), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-3452
CVE-2020-3161 Improper input validation of HTTP requests in IP phone, as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-3161
CVE-2020-3580 Chain: improper input validation (CWE-20) in firewall product leads to XSS
(CWE-79), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-3580
CVE-2021-37147 Chain: caching proxy server has improper input validation (CWE-20) of
headers, allowing HTTP response smuggling (CWE-444) using an "LF line
ending"
https://www.cve.org/CVERecord?id=CVE-2021-37147
CVE-2008-5305 Eval injection in Perl program using an ID that should only contain hyphens
and numbers.
https://www.cve.org/CVERecord?id=CVE-2008-5305
CVE-2008-2223 SQL injection through an ID that was supposed to be numeric.
https://www.cve.org/CVERecord?id=CVE-2008-2223
CVE-2008-3477 lack of input validation in spreadsheet program leads to buffer overflows,
integer overflows, array index errors, and memory corruption.
https://www.cve.org/CVERecord?id=CVE-2008-3477
CVE-2008-3843 insufficient validation enables XSS
https://www.cve.org/CVERecord?id=CVE-2008-3843
CVE-2008-3174 driver in security product allows code execution due to insufficient validation
https://www.cve.org/CVERecord?id=CVE-2008-3174
CVE-2007-3409 infinite loop from DNS packet with a label that points to itself
https://www.cve.org/CVERecord?id=CVE-2007-3409
CVE-2006-6870 infinite loop from DNS packet with a label that points to itself
https://www.cve.org/CVERecord?id=CVE-2006-6870
CVE-2008-1303 missing parameter leads to crash
https://www.cve.org/CVERecord?id=CVE-2008-1303
CWE Version 4.14
CWE-20: Improper Input Validation
CWE-20: Improper Input Validation