CWE-20: Improper Input Validation

Hva svakheten betyr

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Definisjonen gjengis slik MITRE har publisert den, på engelsk.

2 723 sårbarheter i tjenesten peker på denne svakheten

1. CVE-2026-34910 Utnyttes aktivt Kritisk 10.0

   Ubiquiti UniFi OS Improper Input Validation Vulnerability

   A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

2. CVE-2025-20393 Utnyttes aktivt Kritisk 10.0

   Cisco Multiple Products Improper Input Validation Vulnerability

   A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execu…

3. CVE-2024-3400 Utnyttes aktivt Kritisk 10.0

   Palo Alto Networks PAN-OS Command Injection Vulnerability

   A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configura…

4. CVE-2022-24086 Utnyttes aktivt Høy 10.0

   Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

   Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not r…

5. CVE-2021-44228 Utnyttes aktivt Kritisk 10.0

   Apache Log4j2 Remote Code Execution Vulnerability

   Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker contro…

6. CVE-2021-22205 Utnyttes aktivt Kritisk 10.0

   GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

   An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote com…

7. CVE-2020-1350 Utnyttes aktivt Kritisk 10.0

   Microsoft Windows DNS Server Remote Code Execution Vulnerability

   A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

8. CVE-2019-11708 Utnyttes aktivt Kritisk 10.0

   Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

   Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromise…

9. CVE-2026-88771 Utnyttes aktivt Kritisk 9.8

   Citrix NetScaler Improper Input Validation Vulnerability

   Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.…

10. CVE-2026-12569 Utnyttes aktivt Kritisk 9.8

    PTC Windchill and FlexPLM Improper Input Validation Vulnerability

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * Th…

11. CVE-2024-21413 Utnyttes aktivt Kritisk 9.8

    Microsoft Outlook Improper Input Validation Vulnerability

    Microsoft Outlook Remote Code Execution Vulnerability

12. CVE-2023-22515 Utnyttes aktivt Kritisk 9.8

    Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Cent…

13. CVE-2023-2868 Utnyttes aktivt Kritisk 9.8

    Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a …

14. CVE-2023-23397 Utnyttes aktivt Kritisk 9.8

    Microsoft Office Outlook Privilege Escalation Vulnerability

    Microsoft Outlook Elevation of Privilege Vulnerability

15. CVE-2022-47966 Utnyttes aktivt Kritisk 9.8

    Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because th…

16. CVE-2022-29499 Utnyttes aktivt Kritisk 9.8

    Mitel MiVoice Connect Data Validation Vulnerability

    The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

17. CVE-2022-22587 Utnyttes aktivt Kritisk 9.8

    Apple Memory Corruption Vulnerability

    A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able…

18. CVE-2021-35395 Utnyttes aktivt Kritisk 9.8

    Realtek AP-Router SDK Buffer Overflow Vulnerability

    Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface ex…

19. CVE-2021-21985 Utnyttes aktivt Kritisk 9.8

    VMware vCenter Server Improper Input Validation Vulnerability

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A mali…

20. CVE-2021-27104 Utnyttes aktivt Kritisk 9.8

    Accellion FTA OS Command Injection Vulnerability

    Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.

21. CVE-2021-22502 Utnyttes aktivt Kritisk 9.8

    Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

    Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR ser…

22. CVE-2018-19949 Utnyttes aktivt Kritisk 9.8

    QNAP NAS File Station Command Injection Vulnerability

    If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 2020…

23. CVE-2020-3161 Utnyttes aktivt Kritisk 9.8

    Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a de…

24. CVE-2019-7193 Utnyttes aktivt Kritisk 9.8

    QNAP QTS Improper Input Validation Vulnerability

    This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

25. CVE-2019-0604 Utnyttes aktivt Kritisk 9.8

    Microsoft SharePoint Remote Code Execution Vulnerability

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vuln…