Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1287: Improper Validation of Specified Type of Input

Base Incomplete

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

How to prevent it (1 mitigation)

  1. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Source: MITRE CWE-1287

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-76964 Public exploit

    Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

    SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…

    SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager)
  • Critical 9.2
    CVE-2026-114509 Public exploit Scanner template

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Critical 10.0
    CVE-2024-51550 Public exploit

    Data Validation / Sanitization

    Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 9.8
    CVE-2024-4879 Exploited Public exploit Scanner template EPSS 100%

    Jelly Template Injection Vulnerability in ServiceNow UI Macros

    ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servi…

    ServiceNow Now Platform
    KEV Jul 29, 2024
  • Critical 10.0
    CVE-2024-6298 Public exploit EPSS 19%

    remote code execution

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT