Improper Validation of Specified Type of Input
CWE-1287
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
We track 77 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 1 has been exploited in real attacks.
Latest Improper Validation of Specified Type of Input vulnerabilities
- 7.7 High severity
Cisco Adaptive Security Appliance (ASA) Software: Improper Validation of Specified Type of Input
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that is authenticated as a VPN user to cause the dev
- 8.7 High severity
FLEX 5000 I/O: Improper Validation of Specified Type of Input
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection faul
- 8.7 High severity
FLEX 5000 I/O: Improper Validation of Specified Type of Input
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection faul
- 7.5 High severity
Mattermost Confluence Plugin: Improper Validation of Specified Type of Input
Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.
- 7.5 High severity
IE-SW-VL05M-5TX: Improper Validation of Specified Type of Input
An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.
- 8.2 High severity
kyverno: Improper Validation of Specified Type of Input
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review reque
- 7.5 High severity
Mattermost: Improper Validation of Specified Type of Input
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously c
- 7.5 High severity
fastify: Improper Validation of Specified Type of Input
Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a _s
- 8.1 High severity
SAP Approuter Node.js package: Authentication Bypass by Assumed-Immutable Data
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and in
- 7.5 High severity
Mattermost: Improper Validation of Specified Type of Input
Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.
- 7.5 High severity
Mattermost: Improper Validation of Specified Type of Input
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and
- 7.5 High severity
QNX Software Development Platform (SDP): Improper Validation of Specified Type of Input
Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.
- 9.1 Critical severity
OpenVPN: Improper Validation of Specified Type of Input
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
- 7.6 High severity
FileZ Client: Improper Validation of Specified Type of Input
An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading.
- 10.0 Critical severity
ASPECT-Enterprise: Use of Hard-coded Credentials
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02
- 9.8 Critical severity
ASPECT-Enterprise: Improper Validation of Specified Type of Input
Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
ASPECT-Enterprise: Insufficiently Protected Credentials
Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
VPort 07-3 Series: Improper Validation of Specified Type of Input
This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant
- 7.5 High severity
MELSEC iQ-F Series FX5-ENET: Improper Validation of Specified Type of Input
Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ether
- 7.5 High severity
moodle: Improper Validation of Specified Type of Input
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
- 8.8 High severity
JuiceBox Pro 3.0 22kW Cellular: Improper Validation of Specified Type of Input
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
- 8.6 High severity
Cisco Adaptive Security Appliance (ASA) Software: Improper Validation of Specified Type of Input
A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in
- 7.7 High severity
Cisco Adaptive Security Appliance (ASA) Software: Improper Validation of Specified Type of Input
A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly.
- 7.5 High severity
Junos OS: Improper Validation of Specified Type of Input
An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos). When a non-clustered SRX5000
- 9.8 Critical severity
ServiceNow Improper Input Validation Exploited
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servic
- 9.8 Critical severity
ASPECT-Enterprise: Improper Validation of Specified Type of Input
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely
- 8.8 High severity
QRadar Suite Software: Improper Validation of Specified Type of Input
IBM QRadar Suite Software 1.10.12.0 through 1.10.21.0 and IBM Cloud Pak for Security 1.10.12.0 through 1.10.21.0 could allow an authenticated user to execute certain arbitrary commands due to improper input validation. IBM X-Force ID: 272087.
- 9.0 Critical severity
QNX Software Development Platform (SDP): Improper Validation of Specified Type of Input
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process.
- 7.5 High severity
Junos OS: Improper Validation of Specified Type of Input
An Improper Validation of Specified Type of Input vulnerability in Routing Protocol Daemon (RPD) of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). If a BGP update is received over an establishe
- 7.5 High severity
GitLab: Improper Validation of Specified Type of Input
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the detai
- 7.5 High severity
GitLab: Improper Validation of Specified Type of Input
Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.
- 7.5 High severity
GitLab: Improper Validation of Specified Type of Input
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load
- 7.5 High severity
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All…
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for a certain parameter in the s7ontcp.dll. This could allow an unauthenticated remo
- 8.0 High severity
phpCAS: Improper Control of Resource Identifiers
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker
- 7.5 High severity
An Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon…
An Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an attacker to cause an RPD memory leak leading to a Denial of Service (DoS). This memory leak only occurs when the attacke
- 7.2 High severity
elabftw: Placement of User into Incorrect Group
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a new
- 7.5 High severity
A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration…
A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This