CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 moreInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure4.3 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure4.0 Medium
- @clerk nuxtNuxt: Unauthorized Component Instantiation via Server Island Props4.8 Medium
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities9.9 Critical
- electronElectron: window.open features string controls some window options considered privileged5.3 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Security Hardening Release8.6 High
- electronElectron: shell.openPath path validation bypass via embedded null byte6.0 Medium
- opensipsOpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning8.7 High
- tryghost ghostGhost: Archived Offers can be Redeemed4.8 Medium
- lenovo xclarity orchestratorRemote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator8.7 High
- openmeterStored Clickhouse SQL Injection Through Customer Usage Attribution9.3 Critical
- fast-urifast-uri vulnerable to server-side request forgery via malformed IPv6 normalization7.5 High
- samsung rlottieImproper input validation vulnerability in Samsung Open Source rlottie allows Oversized...6.5 Medium
- caliptra core romCaliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)5.6 Medium
- beaugunderson ip-addressip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks6.9 Medium
- beaugunderson ip-addressip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass7.7 High
- socketio socket.ioSocket.IO: Zero-attachment Memory Exhaustion7.5 High
- unisoc (shanghai) technologies co., ltd. udx710In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. udx710In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- unisoc (shanghai) technologies co., ltd. t8100/t9100/t8200/t8300In nr modem, there is a possible improper input validation. This could lead to remote denial of...7.5 High
- bouncycastle bouncy castle for java lts, bc-java, legion of the bouncy castle inc. bc-lts-java +2 moreMTI/A0 DH agreement exponentiates unvalidated peer value9.3 Critical
- No product listedAn issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of...7.5 High
- No product listedA parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message...7.5 High
- No product listedAn issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force...7.5 High
- rustdeskRustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length8.5 High
- freerdpFreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read8.7 High
- freerdpFreeRDP before 3.29.0 Denial of Service via RDPEI PDU8.7 High
- pion stunPion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute5.3 Medium
- free5gc ausf, free5gc +1 morefree5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure6.9 Medium
- thumborThumbor convolution filter allows divide-by-zero in C extension leading to remote DoS7.5 High
- pterodactyl wingsWings: Maliciously crafted packet during SFTP connection handshake causes denial of service7.5 High
- hcl icontrolHCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to...4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass3.7 Low
- red hat build of keycloak, data grid 8, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains4.2 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution3.4 Low
- projectcapsule capsuleCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests6.8 Medium
- aio-libs aiohttpAIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate6.9 Medium
- google chromeInsufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72...4.3 Medium
- google chromeInsufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72...9.6 Critical
- google chromeInsufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed...9.6 Critical
- google chromeInsufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72...9.6 Critical
- google chromeInsufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922...9.6 Critical
- google chromeInsufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72...4.3 Medium
- Show moreLoading…