CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 moreBackstage: Improper entity validation in deprecated Kubernetes services endpoint5.3 Medium
- @backstage plugin-proxy-backend, backstage, linuxfoundation backstage\/plugin-proxy-backend +2 moreBackstage: Improper input validation in proxy-backend6.4 Medium
- corazawaf corazaOWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling5.8 Medium
- kozea weasyprintWeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE8.8 High
- misp sachertortephpMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS8.4 High
- google chromeImproper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeImproper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote...5.4 Medium
- google chromeImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...6.5 Medium
- google chromeImproper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeImproper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote...4.2 Medium
- google chromeImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...5.9 Medium
- google chromeImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...9.6 Critical
- google chromeImproper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeImproper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39...5.4 Medium
- johnson controls illustra standard - l4l chinaL4L5.1 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.3.5 Low
- No product listedDbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from...9.8 Critical
- vllmvLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)6.5 Medium
- vllmvLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service6.5 Medium
- vllmvLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features6.5 Medium
- google androidIn checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a...7.8 High
- red hat multicluster engine for kubernetesHypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane8.8 High
- mitel mivoice office 400Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution8.4 High
- openidentityplatform openamOpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions5.3 Medium
- bytecodealliance wasmtimeWasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow9.4 Critical
- bouncycastle bc-csharpMTI/A0 DHAgreement does not validate the peer's ephemeral value9.1 Critical
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.4.3 Medium
- google androidIn setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent...5.5 Medium
- google androidIn FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to...7.8 High
- taskclusterTaskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)8.7 High
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an...6.7 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an...6.7 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...6.7 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...6.7 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...6.7 Medium
- mispMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph6.2 Medium
- mispMISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image8.3 High
- apache wss4jApache WSS4J: Insufficient Validation of Derived-Key Parameters7.5 High
- mispMISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows8.3 High
- apache software foundation mina sshdApache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server6.5 Medium
- eugeny russhrussh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened7.5 High
- electronElectron: Sandboxed preload code cache can be poisoned by a compromised renderer7.8 High
- @socket.io cluster-engine, socketio socket.io +1 moreSocket.IO: Prototype Pollution via Unsafe Client Session Lookup7.5 High
- pretixCheckout validation bypass1.3 Low
- mozilla firefox, thunderbird +1 moreSandbox escape in the XUL component9.6 Critical
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files3.6 Low
- rhukster dom-sanitizerDOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation4.7 Medium
- authlibAuthlib library contains a signature‑verification bypass vulnerability9.8 Critical
- google chromeInsufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55...4.3 Medium
- deepseek-ai deepseek-harnessdeepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision4.8 Medium
- Show moreLoading…