CWE-179 Incorrect Behavior Order: Early Validation
baseThe product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-1271US | high8.8 | — | ||
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can o… | ||||
| CVE-2022-0567US | critical9.1 | — | ||
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of oth… | ||||
| CVE-2022-25183US | high8.8 | — | ||
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing a… | ||||
| CVE-2022-25182US | high8.8 | — | ||
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrar… | ||||
| CVE-2022-25181US | high8.8 | — | ||
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrar… | ||||
| CVE-2026-46234US | high7.8 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
vsock: fix buffer size clamping order
In vsock_update_buffer_size(), the buffer size was being clamped to the… | ||||
| CVE-2018-6764US | high7.8 | — | ||
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism a… | ||||
| CVE-2026-2391US | high7.5 | — | ||
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory… | ||||
| CVE-2023-4583US | high7.5 | — | ||
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not… | ||||
| CVE-2000-0024US | medium6.4 | — | ||
IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters, aka the "Escape Characte… | ||||
| CVE-2026-32305US | medium5.3OT erhöht | — | ||
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sni… | ||||
| CVE-2025-4759US | medium5.3 | — | ||
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which c… | ||||
| CVE-2026-90813US | medium4.3 | — | ||
A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component… | ||||
| CVE-2024-41686US | low3.3 | — | ||
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that d… | ||||
| CVE-2026-49414US | — | — | ||
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-re… | ||||
| CVE-2026-3832US | — | — | ||
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS han… | ||||
| CVE-2026-25223US | — | — | ||
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas spe… | ||||
04
Angriffsmuster (3)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan