CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- apache camelApache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to…5.3 Medium
- apache camelApache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC m…6.5 Medium
- apache camel, apache software foundation camel dapr +1 moreApache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influen…6.5 Medium
- apache camel, apache software foundation camel jira +1 moreApache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured…5.3 Medium
- apache camel, apache software foundation camel dns +1 moreApache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour9.1 Critical
- apache camelApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including de…9.8 Critical
- apache camelApache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query paramete…9.1 Critical
- apache camel, apache software foundation camel vertx websocket +1 moreApache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control he…7.5 High
- apache camelApache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect…7.5 High
- apache camel, apache software foundation camel lucene +1 moreApache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search quer…7.5 High
- apache camel, apache software foundation camel mail +1 moreApache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters3.7 Low
- apache camelApache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control…7.5 High
- apache camelApache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers9.8 Critical
- apache camelApache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers9.8 Critical
- apache camelApache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query a…5.3 Medium
- cve-searchUnauthenticated arbitrary MongoDB collection read in cve-search9.2 Critical
- ad-security ad minerAD-Security AD_Miner Cache analyse_cache.py request_a deserialization4.8 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization8.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.6 High
- gitea open source git serverGitea repository creation accepts invalid field values9.1 Critical
- webpack-dev-serverwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin header5.3 Medium
- konghq mcp-konnectPrompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP7.4 High
- zcashfoundation zebraZebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC7.1 High
- ubiquiti inc cloud gateways, cloud keys, dream machines +40 more +42 moreA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- ubiquiti inc unifi network applicationA malicious actor with access to the network could exploit an Improper Input Validation...7.5 High
- ubiquiti inc unifi access application, ui unifi access +1 moreA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- google chromeInsufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46...8.3 High
- google chromeInsufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46...5.3 Medium
- google chromeInsufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0...8.3 High
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46...8.3 High
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46...9.6 Critical
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46...9.6 Critical
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0...8.3 High
- elastic kibanaImproper Input Validation in Kibana Leading to Denial of Service6.5 Medium
- wikimedia foundation urlshortener, mediawiki +1 moreUrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG0.0 None
- pretix, pretix pretix-bitpay, pretix-mollie +5 more +7 moreSession takeover vulnerability7.7 High
- pretix pretix-oppwaSSRF with API key leak in pretix-oppwa9.0 Critical
- No product listedAn improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0...7.5 High
- google chromeInsufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47...5.4 Medium
- google chromeInsufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0...4.3 Medium
- google chromeInsufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150...4.2 Medium
- google chromeInsufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47...5.4 Medium
- google chromeInsufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871...5.4 Medium
- google chromeIncorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote...4.3 Medium
- google chromeInsufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to...8.1 High
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote...9.6 Critical
- google chromeInsufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInsufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0...5.3 Medium
- Show moreLoading…