Common Weakness Enumeration
CWE-1285
AllowedImproper Validation of Specified Index, Position, or Offset in Input
Abstraction: Base · Status: Incomplete
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
95 vulnerabilities reference this CWE, most recent first.
GHSA-JH8M-G69P-MV3X
Vulnerability from github – Published: 2023-08-13 12:30 – Updated: 2024-04-04 06:53
VLAI
Details
Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-39389"
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-1285",
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-13T12:15:45Z",
"severity": "HIGH"
},
"details": "Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailability.",
"id": "GHSA-jh8m-g69p-mv3x",
"modified": "2024-04-04T06:53:47Z",
"published": "2023-08-13T12:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39389"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/8"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JQ77-3WFM-PG54
Vulnerability from github – Published: 2025-09-02 21:30 – Updated: 2025-09-02 21:30
VLAI
Details
There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-57775"
],
"database_specific": {
"cwe_ids": [
"CWE-1285",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-02T19:15:31Z",
"severity": "HIGH"
},
"details": "There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab.",
"id": "GHSA-jq77-3wfm-pg54",
"modified": "2025-09-02T21:30:58Z",
"published": "2025-09-02T21:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57775"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M28Q-9CC4-GJ6H
Vulnerability from github – Published: 2024-11-12 15:30 – Updated: 2025-11-03 21:31
VLAI
Details
A guest can trigger an infinite loop in the hda audio driver.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-51564"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T15:15:10Z",
"severity": "HIGH"
},
"details": "A guest can trigger an infinite loop in the hda audio driver.",
"id": "GHSA-m28q-9cc4-gj6h",
"modified": "2025-11-03T21:31:35Z",
"published": "2024-11-12T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51564"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:17.bhyve.asc"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250207-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M297-2WVR-723P
Vulnerability from github – Published: 2025-07-23 18:30 – Updated: 2025-07-23 18:30
VLAI
Details
Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-2633"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-23T16:15:25Z",
"severity": "HIGH"
},
"details": "Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.",
"id": "GHSA-m297-2wvr-723p",
"modified": "2025-07-23T18:30:36Z",
"published": "2025-07-23T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2633"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MP8P-XHGF-RPJV
Vulnerability from github – Published: 2026-01-02 18:30 – Updated: 2026-06-30 03:35
VLAI
Details
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-67268"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-02T16:17:00Z",
"severity": "CRITICAL"
},
"details": "gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.",
"id": "GHSA-mp8p-xhgf-rpjv",
"modified": "2026-06-30T03:35:23Z",
"published": "2026-01-02T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67268"
},
{
"type": "WEB",
"url": "https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0771"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1621"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-67268"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426835"
},
{
"type": "WEB",
"url": "https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md"
},
{
"type": "WEB",
"url": "https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67268.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MQ5V-X68W-MC4F
Vulnerability from github – Published: 2026-02-12 15:32 – Updated: 2026-06-30 03:35
VLAI
Details
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-2006"
],
"database_specific": {
"cwe_ids": [
"CWE-1285",
"CWE-129"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-12T14:16:02Z",
"severity": "HIGH"
},
"details": "Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.",
"id": "GHSA-mq5v-x68w-mc4f",
"modified": "2026-06-30T03:35:36Z",
"published": "2026-02-12T15:32:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2006"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19009"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4509"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4515"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4516"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4518"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4528"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4544"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4546"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4943"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8756"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-2006"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439324"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2006.json"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2026-2006"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19010"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3730"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3887"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4024"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4059"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4063"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4064"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4074"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4075"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4110"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4254"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4441"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4475"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4504"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4505"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:4506"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QQXJ-M5WG-PRQX
Vulnerability from github – Published: 2025-07-30 00:32 – Updated: 2025-07-30 00:32
VLAI
Details
A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-7849"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T22:15:26Z",
"severity": "HIGH"
},
"details": "A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.",
"id": "GHSA-qqxj-m5wg-prqx",
"modified": "2025-07-30T00:32:19Z",
"published": "2025-07-30T00:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7849"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R642-X62F-JQHP
Vulnerability from github – Published: 2024-11-12 15:30 – Updated: 2025-11-03 21:31
VLAI
Details
The NVMe driver queue processing is vulernable to guest-induced infinite loops.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-51566"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T15:15:11Z",
"severity": "MODERATE"
},
"details": "The NVMe driver queue processing is vulernable to guest-induced infinite loops.",
"id": "GHSA-r642-x62f-jqhp",
"modified": "2025-11-03T21:31:36Z",
"published": "2024-11-12T15:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51566"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:17.bhyve.asc"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250207-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-RXM7-9J9M-HC3W
Vulnerability from github – Published: 2025-07-23 18:30 – Updated: 2025-07-23 18:30
VLAI
Details
Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-2634"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-23T16:15:25Z",
"severity": "HIGH"
},
"details": "Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.",
"id": "GHSA-rxm7-9j9m-hc3w",
"modified": "2025-07-23T18:30:36Z",
"published": "2025-07-23T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2634"
},
{
"type": "WEB",
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VPMG-66F3-9F7W
Vulnerability from github – Published: 2023-05-11 15:30 – Updated: 2024-04-04 04:02
VLAI
Details
Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(). :Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-0859"
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-11T13:15:13Z",
"severity": "MODERATE"
},
"details": "Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.",
"id": "GHSA-vpmg-66f3-9f7w",
"modified": "2024-04-04T04:02:32Z",
"published": "2023-05-11T15:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0859"
},
{
"type": "WEB",
"url": "https://canon.jp/support/support-info/230414vulnerability-response"
},
{
"type": "WEB",
"url": "https://psirt.canon/advisory-information/cp2023-001"
},
{
"type": "WEB",
"url": "https://www.canon-europe.com/support/product-security-latest-news"
},
{
"type": "WEB",
"url": "https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediation-Against-Buffer-Overflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
No CAPEC attack patterns related to this CWE.