CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown forminator formsForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts5.3 Medium
- recommenders-team recommendersrecommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization5.1 Medium
daskDebianDask Loader core.py from_npy_stack deserialization5.1 Medium- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)7.5 High
- wevm mppxmppx: Gas Draining with access list6.9 Medium
- wevm mppxmppx: Gas Draining with padding6.9 Medium
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)9.1 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Improper Input Validation (CWE-20)9.3 Critical
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)4.3 Medium
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)5.5 Medium
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)7.5 High
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.5 Medium
- adobe c2pa, c2patool, content credentials command-line tool +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)4.3 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)8.5 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)9.9 Critical
- notepad-plus-plusNotepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)7.8 High
- mispMISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name5.1 Medium
- mispMISP Unauthenticated Blind SSRF via XML Body Processing6.9 Medium
- mispMISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation5.3 Medium
- mispMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread4.8 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference2.3 Low
- arista velocloud orchestrator, arista networks velocloud orchestrator (vco) on-prem +1 moreSecurity Advisory 01839.5 Critical
- laurent22 joplinJoplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory7.0 High
- mispMISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension8.6 High
- mispMISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)6.9 Medium
- dlr-rm stable-baselines3DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization5.3 Medium
- dmlc dgldmlc dgl utils.py _read_torch_data deserialization5.1 Medium
- piskvorky gensimpiskvorky gensim Model Loader utils.py load deserialization5.1 Medium
- watchdog anti-virusWatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL6.9 Medium
- syslifters sysreptorSysReptor: Authenticated RCE by insecure image processing8.8 High
- projectcapsule capsuleCapsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic6.8 Medium
- red hat amq broker 7, build of apache camel 3.33.3.sp2, build of apache camel 4 for quarkus 3 +16 more +18 moreIo.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests7.5 High
- red hat amq broker 7, build of apache camel 3.33.3.sp2, build of apache camel 4 for quarkus 3 +16 more +18 moreIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority7.5 High
- zscaler zia file type controlFile Type Control rule bypass4.4 Medium
- mapster wp mapsMapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter8.8 High
- zohocorp manageengine datasecurity plusManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication...7.5 High
- webrecorder browsertrixBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors9.4 Critical
- midnightbsd mportmport audit can inspect the wrong package when options are present2.0 Low
- mispMISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution8.7 High
- nuxt-modules og-imageNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter6.9 Medium
- laravel pulsercourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation9.4 Critical
- wwbn avideoAVideo through 29.0 Like Counter Desynchronization via Array Parameter5.3 Medium
- cisco ise passive identity connector, identity services engine software +1 moreCisco Identity Services Engine Hardening Release - Input Validation Vulnerabilities9.1 Critical
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service7.5 High
- functional software, inc. sentry seerSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment9.8 Critical
- backstage, linuxfoundation backstage plugin-techdocs-node +1 moreBackstage: Improper input validation in TechDocs MkDocs configuration8.8 High
- arista networks eosSecurity Advisory 01776.0 Medium
- arista networks eosSecurity Advisory 01676.9 Medium
- codepeople appointment hour bookingAppointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission5.3 Medium
- Show moreLoading…