CWE-233 Improper Handling of Parameters
baseThe product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (50)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-7261US | high7.8 | Exploit | ||
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium securit… | ||||
| CVE-2022-45182US | critical9.8 | — | ||
Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter. | ||||
| CVE-2023-20076US | high8.8 | — | ||
A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the underlying host operatin… | ||||
| CVE-2022-0001US | medium6.5 | Exploit | ||
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via loc… | ||||
| CVE-2026-2370US | high8.8 | — | ||
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations tha… | ||||
| CVE-2015-3938US | high7.8 | — | ||
The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter. | ||||
| CVE-2021-1230US | high7.5 | — | ||
A vulnerability with the Border Gateway Protocol (BGP) for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated,… | ||||
| CVE-2023-26549US | high7.5 | — | ||
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality. | ||||
| CVE-2022-3697US | high7.5 | — | ||
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advan… | ||||
| CVE-2022-32261US | high7.5 | — | ||
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow… | ||||
| CVE-2022-22792US | high7.5 | — | ||
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://… | ||||
| CVE-2025-55080US | high7.1 | — | ||
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write. | ||||
| CVE-2024-20306US | medium6.7 | — | ||
A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on… | ||||
| CVE-2022-0004US | medium6.8 | — | ||
Hardware debug modes and processor INIT setting that allow override of locks for some Intel(R) Processors in Intel(R) Boot Guard and Intel(R) TXT may allow an unauthenticated user… | ||||
| CVE-2021-45478US | medium6.5 | — | ||
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.
This issue affects Library Aut… | ||||
| CVE-2021-45477US | medium6.5 | — | ||
Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.
This issue affects Library Aut… | ||||
| CVE-2022-0002US | medium6.5 | — | ||
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. | ||||
| CVE-2020-10069US | medium6.5 | — | ||
Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). For more information,… | ||||
| CVE-2024-9329US | medium6.1 | — | ||
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/d… | ||||
| CVE-2023-40819US | medium6.1 | — | ||
ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability. | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan