Common Weakness Enumeration
CWE-1287
AllowedImproper Validation of Specified Type of Input
Abstraction: Base · Status: Incomplete
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
276 vulnerabilities reference this CWE, most recent first.
GHSA-CQGH-JJ7H-J2HC
Vulnerability from github – Published: 2025-11-24 12:30 – Updated: 2025-11-24 12:30
VLAI
Details
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-41729"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-24T12:15:46Z",
"severity": "HIGH"
},
"details": "An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.",
"id": "GHSA-cqgh-jj7h-j2hc",
"modified": "2025-11-24T12:30:30Z",
"published": "2025-11-24T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41729"
},
{
"type": "WEB",
"url": "https://certvde.com/de/advisories/VDE-2025-094"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CQGQ-FF3F-RJ7R
Vulnerability from github – Published: 2026-05-20 15:35 – Updated: 2026-08-27 15:31
VLAI
Details
Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-5946"
],
"database_specific": {
"cwe_ids": [
"CWE-1287",
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T13:16:40Z",
"severity": "HIGH"
},
"details": "Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) \u2014 for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths \u2014 recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data \u2014 can cause assertion failures in `named`.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.",
"id": "GHSA-cqgq-ff3f-rj7r",
"modified": "2026-08-27T15:31:20Z",
"published": "2026-05-20T15:35:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json"
},
{
"type": "WEB",
"url": "https://kb.isc.org/docs/cve-2026-5946"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.21.22"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.20.23"
},
{
"type": "WEB",
"url": "https://downloads.isc.org/isc/bind9/9.18.49"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-5946"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60383"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:57189"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:55441"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24368"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24367"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24339"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24338"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23360"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F2G8-QCQC-2HMV
Vulnerability from github – Published: 2025-05-27 09:30 – Updated: 2025-05-27 09:30
VLAI
Details
An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-41650"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-27T09:15:21Z",
"severity": "HIGH"
},
"details": "An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.",
"id": "GHSA-f2g8-qcqc-2hmv",
"modified": "2025-05-27T09:30:32Z",
"published": "2025-05-27T09:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41650"
},
{
"type": "WEB",
"url": "https://certvde.com/en/advisories/VDE-2025-044"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F2H8-4W6P-535W
Vulnerability from github – Published: 2025-01-06 15:31 – Updated: 2025-11-03 21:32
VLAI
Details
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or plug-ins.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-5594"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T14:15:08Z",
"severity": "CRITICAL"
},
"details": "OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or plug-ins.",
"id": "GHSA-f2h8-4w6p-535w",
"modified": "2025-11-03T21:32:03Z",
"published": "2025-01-06T15:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5594"
},
{
"type": "WEB",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-5594"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F3VJ-J2M6-8HFJ
Vulnerability from github – Published: 2026-02-12 15:32 – Updated: 2026-02-12 15:32
VLAI
Details
Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-2003"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-12T14:16:02Z",
"severity": "MODERATE"
},
"details": "Improper validation of type \"oidvector\" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.",
"id": "GHSA-f3vj-j2m6-8hfj",
"modified": "2026-02-12T15:32:48Z",
"published": "2026-02-12T15:32:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2003"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2026-2003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F54H-78C9-C24H
Vulnerability from github – Published: 2026-05-22 00:31 – Updated: 2026-06-24 21:11
VLAI
Summary
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Details
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-7887"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-24T21:11:57Z",
"nvd_published_at": "2026-05-21T22:16:49Z",
"severity": "LOW"
},
"details": "For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A\u00a0user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.\u00a0",
"id": "GHSA-f54h-78c9-c24h",
"modified": "2026-06-24T21:11:57Z",
"published": "2026-05-22T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7887"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"
},
{
"type": "PACKAGE",
"url": "https://github.com/concretecms/concretecms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status"
}
GHSA-F6MQ-5M25-4R72
Vulnerability from github – Published: 2021-06-15 16:08 – Updated: 2024-09-17 15:38
VLAI
Summary
go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON
Details
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
Severity
6.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "go.mongodb.org/mongo-driver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-20329"
],
"database_specific": {
"cwe_ids": [
"CWE-1287",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-14T19:11:50Z",
"nvd_published_at": "2021-06-10T17:15:00Z",
"severity": "MODERATE"
},
"details": "Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.",
"id": "GHSA-f6mq-5m25-4r72",
"modified": "2024-09-17T15:38:07Z",
"published": "2021-06-15T16:08:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20329"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-go-driver/pull/622"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/mongo-go-driver"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/GODRIVER-1923"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0112"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON"
}
GHSA-F6RP-FG8W-F27C
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-59277"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:16:09Z",
"severity": "HIGH"
},
"details": "Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-f6rp-fg8w-f27c",
"modified": "2025-10-14T18:30:36Z",
"published": "2025-10-14T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59277"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59277"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F6XW-XQHC-GWG3
Vulnerability from github – Published: 2025-04-08 06:30 – Updated: 2025-04-08 06:30
VLAI
Details
51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-47261"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T06:15:43Z",
"severity": "MODERATE"
},
"details": "51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device.",
"id": "GHSA-f6xw-xqhc-gwg3",
"modified": "2025-04-08T06:30:40Z",
"published": "2025-04-08T06:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47261"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/18/c5/b2/cve-2024-47261pdf-en-US-474505.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FH66-FCV5-JJFR
Vulnerability from github – Published: 2025-10-08 17:51 – Updated: 2025-10-08 17:51
VLAI
Summary
Synapse's invalid device keys degrade federation functionality
Details
Impact
Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers.
Patches
Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.
Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.
Workarounds
The vulnerability can only be exploited by users registered on the victim homeserver.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "matrix-synapse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.138.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "matrix-synapse"
},
"ranges": [
{
"events": [
{
"introduced": "1.139.0rc2"
},
{
"fixed": "1.139.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-61672"
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-08T17:51:02Z",
"nvd_published_at": "2025-10-08T15:16:25Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nLack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. \n\n### Patches\n\nPatched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.\n\nNote that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.\n\n### Workarounds\n\nThe vulnerability can only be exploited by users registered on the victim homeserver.",
"id": "GHSA-fh66-fcv5-jjfr",
"modified": "2025-10-08T17:51:02Z",
"published": "2025-10-08T17:51:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61672"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/pull/17097"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740"
},
{
"type": "PACKAGE",
"url": "https://github.com/element-hq/synapse"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/releases/tag/v1.138.3"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/releases/tag/v1.138.4"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/releases/tag/v1.139.1"
},
{
"type": "WEB",
"url": "https://github.com/element-hq/synapse/releases/tag/v1.139.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Synapse\u0027s invalid device keys degrade federation functionality"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
No CAPEC attack patterns related to this CWE.