CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- rustls Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass 6.9 Medium
- hickory-dns Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser 8.7 High
- hickory-dns hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser 8.7 High
- nxp mcuxpresso sdk NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions 6.8 Medium
- nxp mcuxpresso sdk NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions 6.7 Medium
- openbmb internet of agents OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection 6.9 Medium
-
github.com/canonical/lxdGo LXD has arbitrary file write on client due to trusted image hash 9.9 Critical -
github.com/canonical/lxdGo LXD has argument injection in backup compression algorithm leading to AFW and ACE 9.9 Critical - red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Medium
- suitecrm SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database 8.8 High
- kubernetes ingress-nginx, suse rancher prime rke2 ingress-nginx +1 more ingress-nginx mirror-target self-DOS 2.7 Low
- altium 365 Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes 7.2 High
- hedgedoc HedgeDoc: Missing validation of incoming permission values on change 5.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens 8.1 High
- apache software foundation ofbiz Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation No score
- pocket-id Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences 7.7 High
- nvm-sh nvm nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases 2.1 Low
- npc-worldwide npcpy NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation 5.3 Medium
- ibm mq IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability 8.5 High
- apache software foundation activemq Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection No score
- apache software foundation activemq broker, activemq +1 more Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection No score
- apache software foundation activemq, activemq kahadb +1 more Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal No score
- tanium threat response Tanium addressed an improper input validation vulnerability in Threat Response. 6.5 Medium
- tanium threat response Tanium addressed an improper input validation vulnerability in Threat Response. 4.3 Medium
- google chrome Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote... 5.4 Medium
- google chrome Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local... 7.8 High
- google chrome Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote... No score
- google chrome Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote... 8.8 High
- google chrome Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote... 8.3 High
- google chrome Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote... No score
- google chrome Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote... 8.8 High
- google chrome Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a... No score
- google chrome Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote... 8.8 High
- franklioxygen mytube MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning 4.3 Medium
- enspirit elo Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields 7.4 High
- solarwinds dameware SolarWinds Dameware Command Injection Vulnerability 9.9 Critical
- solarwinds dameware SolarWinds Dameware Buffer Overflow Vulnerability 8.4 High
- parse-community parse-server Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key 6.3 Medium
- freerdp FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry 2.3 Low
- freerdp FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel 7.1 High
- apache software foundation oozie Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership 6.5 Medium
- absolute software secure access Missing length validation in Absolute Secure Access 7.1 High
- absolute software secure access Improper input handling in Secure Access servers 7.1 High
- absolute software secure access Improper input handling in Secure Access server 8.3 High
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input... 4.2 Medium
- apache software foundation arrow rust Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads 9.1 Critical
- jxxghp moviepilot jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization 5.1 Medium
-
kamailioUbuntu A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The... 7.5 High - ag-ui-protocol ag-ui ag-ui-protocol ag-ui Transport Decoder input validation 5.3 Medium
- Show olderLoading…