CWE-1284 · Input Validation and Logic
Improper Validation of Specified Quantity in Input
366CVEs
1exploited
2with a public check
6likely (EPSS 10%+)
SortMost likely exploited
366 CVEs with CWE-1284 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2010-3904In CISA KEVExploitedThe rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addre…Linux · Kernel · CVSS 7.8 · 2010-12-06 | 7.8 | 16% | 2010-12-06 |
| CVE-2025-9316CheckN-central - Authentication BypassN-able · N-central · CVSS 6.9 · 2025-11-12 | 6.9 | 37% | 2025-11-12 |
| CVE-2026-49777CheckWordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCEShapedPlugin, LLC · Product Slider Pro for WooCommerce · CVSS 10 · 2026-06-05 | 10.0 | 1.7% | 2026-06-05 |
| CVE-2021-43267An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploi…Linux · Linux Kernel · 2021-11-02 | – | 58% | 2021-11-02 |
| CVE-2022-36620D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.Dlink · Dir-816 Firmware · 2022-08-31 | – | 24% | 2022-08-31 |
| CVE-2008-1440Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote…Microsoft · Windows Xp · 2008-06-12 | – | 23% | 2008-06-12 |
| CVE-2022-37134D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and the result will be sto…Dlink · Dir-816 Firmware · 2022-08-22 | – | 22% | 2022-08-22 |
| CVE-2009-4488Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary c…Varnish.projects.linpro · Varnish · CVSS 9.8 · 2010-01-13 | 9.8 | 13% | 2010-01-13 |
| CVE-2025-4365NetScaler Console and NetScaler SDX (SVM) - Arbitrary file readNetScaler · Console · CVSS 6.9 · 2025-06-17 | 6.9 | 10% | 2025-06-17 |
| CVE-2025-5349NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management InterfaceNetScaler · ADC · CVSS 8.7 · 2025-06-17 | 8.7 | 6.9% | 2025-06-17 |
| CVE-2021-45462In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.Open5gs · Open5gs · CVSS 7.5 · 2021-12-23 | 7.5 | 4.6% | 2021-12-23 |
| CVE-2008-2374src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows r…Bluez · Bluez-Libs · CVSS 9.8 · 2008-07-07 | 9.8 | 4.3% | 2008-07-07 |
| CVE-2023-38709Apache HTTP Server: HTTP response splittingApache Software Foundation · Apache HTTP Server · CVSS 7.3 · 2024-04-04 | 7.3 | 3.9% | 2024-04-04 |
| CVE-2025-8424Improper access control on the NetScaler Management InterfaceNetScaler · ADC · CVSS 8.7 · 2025-08-26 | 8.7 | 3.7% | 2025-08-26 |
| CVE-2013-0270Keystone: openstack keystone: denial of service via large http request with long tenant nameRed Hat · OpenStack Folsom for RHEL 6 · CVSS 6.5 · 2013-04-12 | 6.5 | 3.2% | 2013-04-12 |
| CVE-2024-6768Denial of Service in CLFS.sysMicrosoft · Windows 10 · CVSS 6.8 · 2024-08-12 | 6.8 | 2.5% | 2024-08-12 |
| CVE-2022-28199NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a…NVIDIA · NVIDIA FLARE · CVSS 6.5 · 2022-09-01 | 6.5 | 2.3% | 2022-09-01 |
| CVE-2021-31346A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All vers…Siemens · Capital Embedded AR Classic 431-422 · CVSS 8.2 · 2021-11-09 | 8.2 | 2.0% | 2021-11-09 |
| CVE-2026-94450Potential denial of service when configured to send Retry packets in s2n-quicAWS · s2n-quic · CVSS 7.5 · 2026-09-22 | 7.5 | 1.9% | 2026-09-22 |
| CVE-2022-40761The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_AllocateOperation with a d…Samsung · Mtower · 2022-09-16 | – | 1.8% | 2022-09-16 |
| CVE-2021-31345A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All vers…Siemens · Capital Embedded AR Classic 431-422 · CVSS 7.5 · 2021-11-09 | 7.5 | 1.6% | 2021-11-09 |
| CVE-2021-31556An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blo…Mediawiki · Mediawiki · 2021-08-12 | – | 1.6% | 2021-08-12 |
| CVE-2022-0214Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of ServiceCustom Popup Builder Project · Popup | Custom Popup Builder · 2022-02-14 | – | 1.6% | 2022-02-14 |
| CVE-2022-21208Denial of Service (DoS)Node-Opcua Project · node-opcua · CVSS 7.5 · 2022-08-23 | 7.5 | 1.5% | 2022-08-23 |
| CVE-2022-2592A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated a…GitLab · GitLab · CVSS 6.5 · 2022-10-17 | 6.5 | 1.5% | 2022-10-17 |
| CVE-2023-41164In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain input…Djangoproject · Django · 2023-11-03 | – | 1.5% | 2023-11-03 |
| CVE-2022-1174A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.…GitLab · GitLab · CVSS 4.3 · 2022-04-04 | 4.3 | 1.5% | 2022-04-04 |
| CVE-2023-43665In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a poten…Djangoproject · Django · 2023-11-03 | – | 1.5% | 2023-11-03 |
| CVE-2020-27217In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that a…The Eclipse Foundation · Eclipse Hono · 2020-11-13 | – | 1.3% | 2020-11-13 |
| CVE-2026-75806Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoSOpenSSL · OpenSSL · CVSS 5.3 · 2026-09-29 | 5.3 | 1.2% | 2026-09-29 |
| CVE-2026-58662Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassApache Software Foundation · Apache Thrift · CVSS 8.7 · 2026-07-27 | 8.7 | 1.1% | 2026-07-27 |
| CVE-2022-25375An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command.…Linux · Linux Kernel · 2022-02-20 | – | 1.1% | 2022-02-20 |
| CVE-2022-0414Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr · dolibarr/dolibarr · CVSS 4.1 · 2022-01-31 | 4.1 | 1.0% | 2022-01-31 |
| CVE-2023-34188The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite…Cesanta · Mongoose · 2023-06-23 | – | 1.0% | 2023-06-23 |
| CVE-2023-30082A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This c…Enhancesoft · Osticket · CVSS 7.5 · 2023-06-14 | 7.5 | 1.0% | 2023-06-14 |
| CVE-2021-45972The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. This allows an attack…Giftrans Project · Giftrans · 2022-01-01 | – | 1.0% | 2022-01-01 |
| CVE-2022-28613Specially Crafted Modbus TCP Packet Vulnerability in RTU500 seriesHitachi Energy · RTU500 series CMU Firmware · CVSS 7.5 · 2022-05-02 | 7.5 | 1.0% | 2022-05-02 |
| CVE-2022-0174Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr · dolibarr/dolibarr · CVSS 4.3 · 2022-01-10 | 4.3 | 1.0% | 2022-01-10 |
| CVE-2022-37312OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.Open-Xchange · Open-Xchange Appsuite · CVSS 5.3 · 2022-12-26 | 5.3 | 1.0% | 2022-12-26 |
| CVE-2022-37311OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.Open-Xchange · Open-Xchange Appsuite · CVSS 5.3 · 2022-12-26 | 5.3 | 1.0% | 2022-12-26 |
| CVE-2025-3511Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter modul…Mitsubishi Electric Corporation · CC-Link IE TSN Remote I/O module NZ2GN2S1-32D · CVSS 7.5 · 2025-04-25 | 7.5 | 0.9% | 2025-04-25 |
| CVE-2023-38744Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the com…OMRON Corporation · CJ2M CPU Unit · 2023-08-03 | – | 0.9% | 2023-08-03 |
| CVE-2022-39313Parse Server crashes when receiving file download request with invalid byte rangeparse-community · parse-server · CVSS 7.5 · 2022-10-24 | 7.5 | 0.8% | 2022-10-24 |
| CVE-2026-92386server-set cookie aborts cookie jar loadcurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 0.8% | 2026-10-20 |
| CVE-2022-4111Improper Validation of Specified Quantity in Input in tooljet/tooljettooljet · tooljet/tooljet · CVSS 6.5 · 2022-11-22 | 6.5 | 0.8% | 2022-11-22 |
| CVE-2026-76763Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsRed Hat · Red Hat build of Quarkus 3.27.5.SP1 · CVSS 7.5 · 2026-08-31 | 7.5 | 0.8% | 2026-08-31 |
| CVE-2022-39272Flux2 vulnerable to Denial of Service due to Improper use of metav1.Durationfluxcd · flux2 · CVSS 5 · 2022-10-21 | 5.0 | 0.8% | 2022-10-21 |
| CVE-2022-2277A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will ca…Hitachi Energy · MicroSCADA X SYS600 · CVSS 7.5 · 2022-09-14 | 7.5 | 0.8% | 2022-09-14 |
| CVE-2021-44693Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.Siemens · SIMATIC Drive Controller CPU 1504D TF · CVSS 4.9 · 2022-12-13 | 4.9 | 0.8% | 2022-12-13 |
| CVE-2024-20149In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User inter…MediaTek, Inc. · MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, MT6769S, MT6769T, MT6769Z, MT6… · CVSS 7.5 · 2025-01-06 | 7.5 | 0.8% | 2025-01-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.