Incorrect Behavior Order: Early Validation
CWE-179
The product validates input before applying protection mechanisms that modify the input.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Incorrect Behavior Order: Early Validation vulnerabilities
- 7.8 High severity
FreeBSD: Incorrect Behavior Order: Early Validation
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was
- 7.5 High severity
fastify: Interpretation Conflict
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab charac
- 8.8 High severity
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw