CWE-1286: Improper Validation of Syntactic Correctness of Input
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
A kind of CWE-20 Improper Input Validation.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser 8.7 High
- samsung exynos 1080, exynos 1280, exynos 1330 +12 more +14 more Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access,... No score
- samsung exynos 1080, samsung semiconductor exynos 9110, exynos modem 5123 +2 more +4 more In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service No score
- mediatek, inc. mediatek chipset In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could... 6.7 Medium
- watchguard fireware os Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service 8.7 High
-
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 more Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv 8.1 High -
libtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 more Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse 9.8 Critical - mtrudel bandit Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit 6.9 Medium
- juniper networks junos os Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution 9.2 Critical
- rabbitmq rabbitmq-server RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers 5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Hyper-V Spoofing Vulnerability 8.8 High
- tink-crypto tink-go Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets 6.9 Medium
- barco clickshare cx-20 gen2 Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input 7.1 High
-
libnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 more Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode 7.5 High -
libnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 more Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode 9.1 Critical - http4s Http4s: Set-Cookie rendering does not escape attribute delimiters 4.8 Medium
- brainzcompany zenius ems 8.0 Authentication bypass using an alternate path or channel and Improper validation of syntactic... 8.7 High
- traefik Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging 8.8 High
- @xmldom xmldom xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content 6.9 Medium
- mastodon Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses 6.3 Medium
- m-files corporation server Denial-of-service vulnerability in M-Files Server 6.9 Medium
- qualcomm ar8031 firmware, ar8035 firmware, cq7790 firmware +209 more +211 more Improper Validation of Syntactic Correctness of Input in Automotive Linux OS 7.6 High
- juniper junos, juniper networks junos os +1 more Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash 8.7 High
- guzzle Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle 5.8 Medium
- @fedify fedify, vocab-runtime +1 more Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges 8.6 High
- arista networks eos Arista EOS Dataplane Denial of Service via Malformed IPsec Packet 8.7 High
- dräger sc 6002xl, sc 7000, sc6802xl +2 more +4 more Dräger SC Monitoring Devices DoS via Malformed Network Packet 7.1 High
- dräger atlan a350 Dräger Atlan A350 1.00 <= 1.01 DoS via Medibus Interface 6.3 Medium
- dräger perseus a500 Dräger Perseus A500 2.00-2.02 DoS via Medibus Interface 6.3 Medium
- qualcomm ar8031 firmware, ar8035 firmware, cologne firmware +216 more +218 more Improper Validation of Syntactic Correctness of Input in Display 7.2 High
- qualcomm 5g fixed wireless access platform firmware, apq8098 firmware, ar8031 firmware +271 more +273 more Improper Validation of Syntactic Correctness of Input in Display 7.2 High
- qualcomm ar8031 firmware, ar8035 firmware, cologne firmware +213 more +215 more Improper Validation of Syntactic Correctness of Input in Kernel 7.2 High
- qualcomm ar8031 firmware, ar8035 firmware, cologne firmware +217 more +219 more Improper Validation of Syntactic Correctness of Input in Kernel 7.2 High
- xx-net XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py 5.1 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 more Keycloak: keycloak: denial of service via specially crafted saml input 7.5 High
- m-files corporation server Denial of service vulnerability in M-Files Server 7.1 High
- eclipse openj9, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 more Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update 8.7 High
- snowflake cortex code cli Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface 8.3 High
- stigtsp net::cidr::lite, net\ +1 more Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass 7.5 High
- juniper junos, juniper networks junos os +1 more Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes 8.7 High
- rack Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. 4.8 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead 7.5 High
- cisco ios xe software A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could... 5.4 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS has pre-auth server panic via leafnode handling 7.5 High
- ibm qradar, qradar security information and event manager +1 more IBM QRadar SIEM Information Disclosure 5.0 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 more Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames 3.9 Low
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 more Incorrect parsing of IPv6 host literals in net/url 7.5 High
- 2n access commander API - Insufficient Input Validation 5.3 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 more Microsoft Exchange Server Spoofing Vulnerability 6.5 Medium
- facturascripts FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause 8.3 High
- Show olderLoading…