VYPR

CWE-20

Improper Input Validation

ClassStableLikelihood: High

Description

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9

CVEs mapped to this weakness (8,003)

page 148 of 401
  • CVE-2016-9452MedNov 25, 2016
    Drupal
    Drupal
    risk 0.42cvss 6.5epss 0.02

    The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.

  • CVE-2016-2996MedNov 24, 2016
    IBM
    Security Privileged Identity Manager
    risk 0.42cvss 6.5epss 0.01

    IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, allows remote authenticated users to append to arbitrary files via unspecified vectors.

  • CVE-2016-7965MedOct 31, 2016
    Dokuwiki
    Dokuwiki
    risk 0.42cvss 6.5epss 0.01

    DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be…

  • CVE-2016-6440MedOct 27, 2016
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.42cvss 6.5epss 0.01

    The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.0(1.10000.10),…

  • CVE-2016-1454MedOct 6, 2016
    Cisco Systems, Inc.
    Nx OS
    risk 0.42cvss 6.5epss 0.02

    Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device reload) by leveraging a peer relationship to send a crafted BGP UPDATE message, aka Bug…

  • CVE-2016-8277MedOct 3, 2016
    Huawei
    USG9500
    risk 0.42cvss 6.5epss 0.01

    Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified command parameter.

  • CVE-2016-6901MedSep 26, 2016
    Huawei
    AR100
    risk 0.42cvss 6.5epss 0.01

    Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause…

  • CVE-2016-5174MedSep 25, 2016
    Google
    Chrome
    risk 0.42cvss 6.5epss 0.01

    browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site.

  • CVE-2016-6412MedSep 24, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.01

    The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers, aka Bug ID CSCuz84773.

  • CVE-2016-6410MedSep 24, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.01

    The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE, when the IOx feature set is enabled, allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuy19856.

  • CVE-2014-2146MedSep 22, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.01

    The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles zone checking for existing sessions, which allows remote attackers to bypass intended resource-access restrictions via spoofed traffic that…

  • CVE-2016-6824MedSep 22, 2016
    Huawei
    AC6605
    risk 0.42cvss 6.5epss 0.01

    Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to cause a denial of service (device restart) via crafted CAPWAP packets.

  • CVE-2015-8923MedSep 20, 2016
    Libarchive
    Libarchive
    risk 0.42cvss 6.5epss 0.03

    The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.

  • CVE-2016-6405MedSep 18, 2016
    Cisco Systems, Inc.
    Fog Director
    risk 0.42cvss 6.5epss 0.01

    Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.

  • CVE-2016-4852MedSep 12, 2016
    YoruFukurou
    YoruFukurou
    risk 0.42cvss 6.5epss 0.02

    YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character…

  • CVE-2016-6361MedAug 22, 2016
    Cisco Systems, Inc.
    Aironet 1800
    risk 0.42cvss 6.5epss 0.01

    The Aggregated MAC Protocol Data Unit (AMPDU) implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via a crafted AMPDU header, aka Bug ID…

  • CVE-2016-6512MedAug 6, 2016
    Wireshark
    Wireshark
    risk 0.42cvss 5.9epss 0.08

    epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors.

  • CVE-2016-6503MedAug 6, 2016
    Wireshark
    Wireshark
    risk 0.42cvss 5.9epss 0.06

    The CORBA IDL dissectors in Wireshark 2.x before 2.0.5 on 64-bit Windows platforms do not properly interact with Visual C++ compiler options, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2016-2839MedAug 5, 2016
    Mozilla Corporation
    Firefox
    risk 0.42cvss 6.5epss 0.02

    Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_extents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service (application crash) via a…

  • CVE-2016-5135MedJul 23, 2016
    Google
    Chrome
    risk 0.42cvss 6.5epss 0.02

    WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP)…