Weakness (CWE)
CWE-1284: Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
How to prevent it (1 mitigation)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Source: MITRE CWE-1284
190 results · Clear filters · Feed
-
Medium 5.9
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to byp…
-
Medium 6.7
Improper validation of specified quantity in input in the MigTD vsock packet handling for the Intel(R) TDX Migration Tr…
-
Medium 5.5
Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause …
-
Medium 5.3
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchange…
-
Medium 4.2
STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channe…
-
Medium 5.3
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of se…
-
Medium 6.9
Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSO…
-
Medium 6.3
Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_inte…
-
Medium 5.9
Forge: AES-GCM authentication bypass via unvalidated tagLength option
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an ap…
-
Medium 6.5
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-…
-
Medium 6.5
zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reache…
-
Medium 4.8
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly…
-
Medium 4.3CVE-2026-107079 Public exploit
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL param…
-
Medium 6.9
Module Manager object lookup validates one byte of a module's search name
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the rec…
-
Medium 4.3
WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.
-
Medium 5.3
WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a th…
-
Medium 6.5
Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled
An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message.
-
Medium 6.5
Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message.
-
Medium 6.5
Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Fl…
-
Medium 6.5
Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when…
-
Medium 6.5
Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.
-
Medium 6.5
Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when …
-
Medium 4.3
Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption
An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker with access to an ICCP peer session to cause memory disclosure and disruption of the l2ald daemon vi…
-
Medium 6.5
Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
-
Medium 4.3
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
-
Medium 5.3
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexi…
-
Medium 5.4
WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.
-
Medium 5.1
Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries …
-
Medium 6.5
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm…
-
Medium 5.3
WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability
Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Cu…
-
Medium 5.3
WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.
-
Medium 4.9
Kiteworks Core Improper Validation of Specified Quantity in Input
Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to app…
-
Medium 5.4
WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
-
Medium 6.9
Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain ac…
-
Medium 5.3
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacke…
-
Medium 5.7
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function …
-
Medium 5.4
Multiple vulnerabilities in IBM Controller
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
-
Medium 6.3
BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bound…
-
Medium 6.5
Security Advisory 0171
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
-
Medium 5.7
An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. …