CWE-1284 · Improper Validation of Specified Quantity in Input (page 3)
Page 3 of 5 — CVEs classified under CWE-1284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13507 | Medium | 6.5 | 2025-11-25 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and… |
CVE-2025-54515 | | 2025-11-23 | The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands… | |
CVE-2025-48507 | | 2025-11-23 | The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memorie… | |
CVE-2025-9316 | | 2025-11-12 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. | |
CVE-2025-10259 | Medium | 5.3 | 2025-11-06 | Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module… |
CVE-2025-36092 | Medium | 6.5 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation… |
CVE-2025-11568 | Medium | 4.4 | 2025-10-15 | A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary per… |
CVE-2025-61938 | High | 7.5 | 2025-10-15 | When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement set… |
CVE-2025-11594 | Medium | 5.3 | 2025-10-11 | A vulnerability has been found in ywxbear PHP-Bookstore-Website-Example and PHP Basic BookStore Website up to 0e0b9f542f7a2d90a8d7f8c83caca69294e234e4. This is… |
CVE-2025-0038 | Medium | 6.6 | 2025-10-06 | In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or pr… |
CVE-2025-43793 | High | 7.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 G… |
CVE-2025-2256 | High | 7.5 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-10094 | Medium | 6.5 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-32689 | High | 7.5 | 2025-09-09 | Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2. |
CVE-2024-36346 | Medium | 6.0 | 2025-09-06 | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially caus… |
CVE-2025-39700 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() trie… |
CVE-2025-58835 | Medium | 5.3 | 2025-09-05 | Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo bonus-for-woo allows Accessing Functionality Not Properly Constrained… |
CVE-2025-5808 | | 2025-08-29 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fro… | |
CVE-2025-8424 | | 2025-08-26 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Clu… | |
CVE-2025-55398 | Critical | 9.8 | 2025-08-22 | An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders… |
CVE-2025-8320 | High | 8.8 | 2025-07-30 | Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2025-43881 | Medium | 4.3 | 2025-07-23 | Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a denial of service (DoS)… |
CVE-2025-41100 | | 2025-07-21 | Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the a… | |
CVE-2022-50020 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the… |
CVE-2025-5349 | High | 8.8 | 2025-06-17 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway |
CVE-2025-4365 | High | 7.5 | 2025-06-17 | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
CVE-2025-49292 | Medium | 4.3 | 2025-06-06 | Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Build… |
CVE-2025-5257 | Medium | 6.5 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially in… |
CVE-2025-2826 | Low | 2.6 | 2025-05-27 | n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or mo… |
CVE-2024-9448 | High | 7.5 | 2025-05-08 | On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rule… |
CVE-2025-20151 | Medium | 4.3 | 2025-05-07 | A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software coul… |
CVE-2025-32399 | Medium | 5.3 | 2025-05-07 | An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library to enter an infinit… |
CVE-2025-46656 | Low | 2.9 | 2025-04-26 | python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consu… |
CVE-2025-3511 | High | 7.5 | 2025-04-25 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Dig… |
CVE-2025-43972 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a… |
CVE-2025-43970 | Medium | 4.3 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36… |
CVE-2025-43964 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. |
CVE-2025-29784 | High | 7.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum sear… |
CVE-2025-32415 | Low | 2.9 | 2025-04-17 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XM… |
CVE-2025-25178 | High | 7.8 | 2025-04-04 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption. |
CVE-2024-45351 | High | 7.8 | 2025-03-26 | A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be explo… |
CVE-2024-8000 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in… |
CVE-2025-0286 | High | 8.4 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate t… |
CVE-2025-0285 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate… |
CVE-2024-53879 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53878 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2023-20508 | Medium | 5.0 | 2025-02-12 | Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, pot… |
CVE-2023-31331 | Low | 3.0 | 2025-02-11 | Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption… |
CVE-2023-20582 | Medium | 5.3 | 2025-02-11 | Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP check… |
CVE-2023-20581 | Low | 2.5 | 2025-02-11 | Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory integrity. |
CVE-2023-20515 | Medium | 5.7 | 2025-02-11 | Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integri… |
CVE-2025-24100 | Low | 3.3 | 2025-01-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be abl… |
CVE-2024-55407 | High | 7.8 | 2025-01-06 | An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplyin… |
CVE-2024-20149 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2024-56716 | Medium | 5.5 | 2024-12-29 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevent bad user input in nsim_dev_health_break_write() If either a zero count… |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-52901 | Medium | 6.5 | 2024-12-12 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation. |
CVE-2024-7488 | Medium | 5.3 | 2024-12-04 | Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks… |
CVE-2024-39343 | High | 7.0 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123, and Modem 5300. T… |
CVE-2024-9369 | Critical | 9.6 | 2024-11-27 | Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an o… |
CVE-2024-47257 | High | 7.5 | 2024-11-26 | Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailabl… |
CVE-2024-6068 | High | 7.3 | 2024-11-14 | A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information a… |
CVE-2024-48290 | Medium | 4.3 | 2024-11-07 | An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2024-7316 | Medium | 5.9 | 2024-10-17 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker to cause Denial of… |
CVE-2024-8508 | Medium | 5.3 | 2024-10-03 | NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compr… |
CVE-2022-25769 | High | 7.2 | 2024-09-18 | ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the applicatio… |
CVE-2024-8887 | Critical | 10.0 | 2024-09-18 | CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the… |
CVE-2024-5931 | Medium | 6.3 | 2024-09-13 | BT: Unchecked user input in bap_broadcast_assistant |
CVE-2024-31416 | Medium | 5.6 | 2024-09-13 | The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of th… |
CVE-2024-8558 | Medium | 4.3 | 2024-09-07 | A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-42416 | High | 8.8 | 2024-09-05 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kerne… |
CVE-2024-0111 | Medium | 4.4 | 2024-08-31 | NVIDIA CUDA Toolkit contains a vulnerability in command 'cuobjdump' where a user may cause a crash or produce incorrect output by passing a malformed ELF file… |
CVE-2023-31310 | Medium | 5.0 | 2024-08-13 | Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input se… |
CVE-2023-31304 | Low | 2.3 | 2024-08-13 | Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lane count and speed… |
CVE-2024-6768 | | 2024-08-12 | A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authe… | |
CVE-2024-41991 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are… |
CVE-2024-31957 | Medium | 6.2 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native handles, which can… |
CVE-2024-27362 | Medium | 4.4 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly chec… |
CVE-2024-27360 | Medium | 6.0 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, and Exyno… |
CVE-2024-39697 | High | 8.6 | 2024-07-09 | phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic… |
CVE-2024-3036 | Medium | 5.7 | 2024-06-21 | Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending… |
CVE-2024-38659 | High | 7.3 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that… |
CVE-2024-5102 | High | 7.0 | 2024-06-10 | A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run pro… |
CVE-2021-47251 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: mac80211: fix skb length check in ieee80211_scan_rx() Replace hard-coded compile-time con… |
CVE-2024-35965 | High | 7.1 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before… |
CVE-2024-35964 | High | 7.1 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not validating setsockopt user input Check user input length before c… |
CVE-2024-35963 | High | 7.1 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length bef… |
CVE-2024-30527 | High | 7.5 | 2024-05-17 | Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden… |
CVE-2024-24715 | Medium | 6.5 | 2024-05-17 | Improper Validation of Specified Quantity in Input vulnerability in The Events Calendar BookIt allows Manipulating Hidden Fields.This issue affects BookIt: fro… |
CVE-2024-3317 | Medium | 6.5 | 2024-05-15 | An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processi… |
CVE-2024-3185 | Medium | 6.8 | 2024-04-23 | A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an atta… |
CVE-2024-23593 | Medium | 6.7 | 2024-04-15 | A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from 2012 to 2014 that… |
CVE-2023-52343 | Medium | 5.5 | 2024-04-08 | In SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote information disclosure… |
CVE-2023-38709 | High | 7.3 | 2024-04-04 | Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HT… |
CVE-2024-24690 | Medium | 5.4 | 2024-02-14 | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-4518 | Medium | 6.5 | 2023-12-01 | A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the devic… |
CVE-2023-23549 | Low | 2.7 | 2023-11-15 | Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long ho… |
CVE-2023-43665 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) ar… |
CVE-2023-41164 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) atta… |
CVE-2023-36839 | Medium | 6.5 | 2023-10-12 | An Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS… |