Improper Validation of Specified Quantity in Input
CWE-1284
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
We track 203 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 2 have been exploited in real attacks.
Latest Improper Validation of Specified Quantity in Input vulnerabilities
- 7.5 High severity
GitLab: Improper Validation of Specified Quantity in Input
An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multipl
- 7.5 High severity
WP SmartPay: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2.
- 7.3 High severity
Self Service Password Reset: Improper Validation of Specified Quantity in Input
Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset from before 4.8 patch 3.
- 8.7 High severity
ADC: Improper Validation of Specified Quantity in Input
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access
- 8.8 High severity
Wall Connector: Improper Validation of Specified Quantity in Input
Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication i
- 7.5 High severity
EOS: Improper Validation of Specified Quantity in Input
On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped a
- 7.5 High severity
P-Net: Improper Validation of Specified Quantity in Input
An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library to enter an infinite loop by sending a malicious RPC packet.
- 7.5 High severity
CC-Link IE TSN Remote I/O module NZ2GN2S1-32D: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter module, CC-Link IE TSN Digital-Analog Converter module, CC-Link IE TSN FPGA module, CC
- 7.5 High severity
GoBGP: Improper Validation of Specified Quantity in Input
An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.
- 7.5 High severity
NamelessMC is a free, easy to use & powerful website software for Minecraft servers.
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search querie
- 7.5 High severity
libxml2: Out-of-bounds Read
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XM
- 7.8 High severity
Game center application: Improper Validation of Specified Quantity in Input
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- 8.4 High severity
Partition Manager: Improper Validation of Specified Quantity in Input
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim
- 7.8 High severity
Migrate OS to SSD: Improper Validation of Specified Quantity in Input
Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploi
- 7.5 High severity
MT2735, MT2737, MT6767, MT6768, MT6769…: Improper Validation of Specified Quantity in Input
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01231341 / MOLY01263331 / MO
- 7.0 High severity
Exynos 2100 Firmware: Improper Validation of Specified Quantity in Input
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123, and Modem 5300. The baseband software does not properly check the length specified by the MM (Mobility Management) mod
- 9.6 Critical severity
Chrome: Improper Validation of Specified Quantity in Input
Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- 7.5 High severity
AXIS Q6128-E PTZ Network Camera: Improper Validation of Specified Quantity in Input
Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailable in the network. Axis has released patched AXIS OS versions for the highlighted flaw for products th
- 7.3 High severity
Arena Input Analyzer: Improper Validation of Specified Quantity in Input
A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DF
- 9.1 Critical severity
Mautic: Improper Validation of Specified Quantity in Input
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the
- 8.6 High severity
CIRCUTOR Q-SMT: Improper Validation of Specified Quantity in Input
CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities imp
- 8.8 High severity
FreeBSD: Improper Validation of Specified Quantity in Input
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vuln
- 7.5 High severity
django: Improper Validation of Specified Quantity in Input
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicod
- 7.5 High severity
Exynos 2200 Firmware: Improper Validation of Specified Quantity in Input
A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native handles, which can result in a DoS(Denial of Service) attack by unmapping an invalid length.
- 7.5 High severity
Exynos 1280 Firmware: Improper Validation of Specified Quantity in Input
A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly check the length of the data, which can lead to a Information disclosure.
- 7.5 High severity
Exynos 850 Firmware: Improper Validation of Specified Quantity in Input
A vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, and Exynos W930 where they do not properly check length of the data, which can lead to a Denial of Service.
- 8.6 High severity
rust-phonenumber: Improper Access Control
phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber,
- 7.1 High severity
Linux: Improper Validation of Specified Quantity in Input
In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_I
- 7.0 High severity
Antivirus: Improper Link Resolution Before File Access
A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\SYSTEM. The vulnerability exists within the "Repair" (settings -> troubleshoot
- 7.1 High severity
Linux: Improper Validation of Specified Quantity in Input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before copying data.
- 7.1 High severity
Linux: Improper Validation of Specified Quantity in Input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not validating setsockopt user input Check user input length before copying data.
- 7.1 High severity
Linux: Improper Validation of Specified Quantity in Input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.
- 7.5 High severity
WP Express Checkout (Accept PayPal Payments): Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.
- 7.3 High severity
Apache HTTP Server: Improper Validation of Specified Quantity in Input
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
- 7.5 High severity
Relion670: Improper Validation of Specified Quantity in Input
A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.
- 7.5 High severity
Django: Improper Validation of Specified Quantity in Input
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentiall
- 7.5 High severity
Django: Improper Validation of Specified Quantity in Input
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- 8.1 High severity
hydra: Improper Validation of Specified Quantity in Input
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transa
- 7.5 High severity
blurhash-rs: Improper Validation of Specified Quantity in Input
blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-gua
- 7.5 High severity
rust-phonenumber: Improper Validation of Specified Quantity in Input
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a