VYPR

CWE-20

Improper Input Validation

ClassStableLikelihood: High

Description

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9

CVEs mapped to this weakness (8,003)

page 18 of 401
  • CVE-2016-1395CriJun 19, 2016
    Cisco Systems, Inc.
    Rv110w
    risk 0.64cvss 9.8epss 0.05

    The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID…

  • CVE-2016-4165CriJun 16, 2016
    Adobe Inc.
    Brackets
    risk 0.64cvss 9.8epss 0.04

    The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input.

  • CVE-2016-2786CriJun 10, 2016
    Puppet (software)
    Puppet Enterprise
    risk 0.64cvss 9.8epss 0.02

    The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

  • CVE-2016-4368CriJun 8, 2016
    HPE
    Universal CMDB
    risk 0.64cvss 9.8epss 0.05

    HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC)…

  • CVE-2014-9746CriJun 7, 2016
    FreeType
    Freetype
    risk 0.64cvss 9.8epss 0.03

    The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values,…

  • CVE-2016-4538CriMay 22, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.06

    The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a…

  • CVE-2016-4537CriMay 22, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.06

    The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.

  • CVE-2016-4072CriMay 20, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.06

    The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.

  • CVE-2015-5589CriMay 16, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.06

    The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, which allows remote attackers to cause a denial of service (segmentation fault) or possibly…

  • CVE-2016-0889CriApr 15, 2016
    Dell
    Emc Unisphere
    risk 0.64cvss 9.8epss 0.03

    An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.

  • CVE-2016-3655CriApr 12, 2016
    Paloaltonetworks
    Pan OS
    risk 0.64cvss 9.8epss 0.03

    The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.

  • CVE-2016-1291CriApr 6, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.64cvss 9.8epss 0.07

    Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.

  • CVE-2016-1998CriMar 22, 2016
    HPE
    Service Manager
    risk 0.64cvss 9.8epss 0.07

    HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-1997CriMar 22, 2016
    HPE
    Operations Orchestration content
    risk 0.64cvss 9.8epss 0.07

    HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-0815CriMar 12, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.03

    The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2015-8360CriFeb 8, 2016
    Atlassian
    Bamboo
    risk 0.64cvss 9.8epss 0.03

    An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.

  • CVE-2014-9757CriFeb 8, 2016
    Atlassian
    Bamboo
    risk 0.64cvss 9.8epss 0.02

    The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

  • CVE-2010-4042CriOct 21, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.02

    Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements."

  • CVE-2010-2076CriAug 19, 2010
    Apache
    Cxf
    risk 0.64cvss 9.8epss 0.10

    Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read…

  • CVE-2025-1098HigMar 25, 2025
    Cri O
    Ingress Nginx
    risk 0.63cvss 8.8epss 0.83

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of…