CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google cloud secops soar, google security operations soar +1 moreRCE in SecOps SOAR server via user-provided Python packages8.6 High
- google androidIn multiple locations, there is a possible way for an application on a work profile to set the...7.8 High
- google androidIn multiple locations, there is a possible bypass of user profile boundary with a forwarded...7.8 High
- infinera mtc-9, nokia infinera mtc-9 firmware +1 moreImproper input validation in Netconf service in Infinera MTC-96.5 Medium
- infinera mtc-9, nokia infinera mtc-9 firmware +1 moreImproper input validation in XML Management service in Infinera MTC-97.5 High
- thermofisher torrent suite softwareAn issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote...7.2 High
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +29 more +31 moreUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded7.5 High
- splunk, splunk cloud platform, enterprise +1 more +3 moreImproper Input Validation in "label" column field in Splunk Secure Gateway App4.3 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code Command Validation Bypass Allows Arbitrary Code Execution8.7 High
- feehi feehicmsFeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management6.5 Medium
- syntax-tree mdast-util-to-hastmdast-util-to-hast unsanitized class attribute6.9 Medium
- socomec diris digiware m-70, diris m-70 firmware +1 moreA buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware...8.6 High
- nutzam nutzbootnutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization6.3 Medium
- tempus-ex hello-video-codecImproper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video...6.5 Medium
- google androidIn __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input...7.8 High
- google androidIn setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations...7.8 High
- google androidIn multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper...7.8 High
- google androidIn init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input...7.8 High
- google androidIn multiple locations, there is a possible permanent denial of service due to improper input...5.5 Medium
- google androidIn onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion...7.3 High
- google androidIn disassociate of DisassociationProcessor.java, there is a possible way for an app to continue...7.8 High
- google androidIn tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible...7.8 High
- google androidIn AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to...5.5 Medium
- google androidIn notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due...6.7 Medium
- orangehrmOrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow8.7 High
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core is vulnerable to Improper Input Validation6.3 Medium
- danny-avila librechatLibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability8.6 High
- cyberark secure web sessions extensionClient-Side Denial of Service Condition in SWS Extension prior to version 2.2.303054.8 Medium
- automated logic zone controllersAutomated Logic and Carrier Zone Controllers malformed packets denial of service8.7 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreAuthenticated Root Remote Code Execution through improper filtering of HTTP post request parameters9.3 Critical
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause...5.7 Medium
- hcl software inotesHCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,8.1 High
- google cloud lookerArbitrary File Write in Denodo dialect of Looker allows Remote Code Execution7.7 High
- google cloud lookerRemote Command Execution in Looker via IBM DB2 JDBC drive7.7 High
- wolfsslTLS 1.2 Client Can Downgrade Digest Used2.3 Low
- wolfsslPotential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello6.3 Medium
- wofssl wolfsslDoS Vulnerability in wolfSSL TLS 1.3 CKS Extension2.3 Low
- wolfsslImproper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify2.1 Low
- roocode roo code, roocodeinc roo-code +1 moreRoo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug8.1 High
- vllmVLLM deserialization vulnerability leading to DoS and potential RCE8.8 High
- tp-link system inc. tl-wr940n v6UPnP DOS in TL-WR940N V67.1 High
- homarrHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload8.1 High
- timeslotplugins time slot – booking and appointment systemBooking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending5.3 Medium
- qvidium opera11 firmwareThe QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code...9.8 Critical
- maykinmedia open forms, open-formulieren open-forms +1 moreOpen Forms prefill data in read-only components can be tampered4.3 Medium
- maxum rumpus, pcman ftp server +1 moreCWE-20 Improper Input Validation4.5 Medium
- nettec as digi on-prem managerAuthenticated SQL injection in API - Digi On-Prem Manager8.8 High
- beims contractor webUnsanitized parameter input leading to SQL Injection vulnerability9.4 Critical
- directusDirectus Vulnerable to Stored Cross-site Scripting5.5 Medium
- minttyZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability5.3 Medium
- Show moreLoading…