Common Weakness Enumeration
CWE-1288
AllowedImproper Validation of Consistency within Input
Abstraction: Base · Status: Incomplete
The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
61 vulnerabilities reference this CWE, most recent first.
GHSA-FG8X-Q69G-4QP3
Vulnerability from github – Published: 2025-10-30 00:31 – Updated: 2025-10-30 17:05
VLAI
Summary
Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables
Details
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/reverse_proxy_header"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-10929"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-30T17:05:15Z",
"nvd_published_at": "2025-10-30T00:15:34Z",
"severity": "MODERATE"
},
"details": "Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.",
"id": "GHSA-fg8x-q69g-4qp3",
"modified": "2025-10-30T17:05:15Z",
"published": "2025-10-30T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10929"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2025-111"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables"
}
GHSA-FHVF-82GH-PPGJ
Vulnerability from github – Published: 2024-10-21 15:32 – Updated: 2024-10-21 15:32
VLAI
Details
prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-8305"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T15:15:04Z",
"severity": "MODERATE"
},
"details": "prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4",
"id": "GHSA-fhvf-82gh-ppgj",
"modified": "2024-10-21T15:32:27Z",
"published": "2024-10-21T15:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8305"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-92382"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G3QW-W3WP-F3M2
Vulnerability from github – Published: 2023-11-14 21:31 – Updated: 2025-08-22 18:31
VLAI
Details
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2023-32701"
],
"database_specific": {
"cwe_ids": [
"CWE-1288",
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T19:15:27Z",
"severity": "HIGH"
},
"details": "Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition.",
"id": "GHSA-g3qw-w3wp-f3m2",
"modified": "2025-08-22T18:31:10Z",
"published": "2023-11-14T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32701"
},
{
"type": "WEB",
"url": "https://support.blackberry.com/kb/articleDetail?articleNumber=000112401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGCQ-59JX-W43V
Vulnerability from github – Published: 2024-03-28 15:30 – Updated: 2024-03-28 15:30
VLAI
Details
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
Severity
4.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-31140"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T15:15:48Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools",
"id": "GHSA-jgcq-59jx-w43v",
"modified": "2024-03-28T15:30:34Z",
"published": "2024-03-28T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31140"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JH3J-GC93-659H
Vulnerability from github – Published: 2026-02-02 15:30 – Updated: 2026-02-02 15:30
VLAI
Details
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
Severity
7.7 (High)
{
"affected": [],
"aliases": [
"CVE-2022-50976"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-02T15:16:28Z",
"severity": "HIGH"
},
"details": "A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.",
"id": "GHSA-jh3j-gc93-659h",
"modified": "2026-02-02T15:30:34Z",
"published": "2026-02-02T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50976"
},
{
"type": "WEB",
"url": "https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.html"
},
{
"type": "WEB",
"url": "https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PQWQ-MV6W-J3QF
Vulnerability from github – Published: 2026-10-14 18:32 – Updated: 2026-10-14 18:32
VLAI
Details
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-101951"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T17:17:48Z",
"severity": "HIGH"
},
"details": "An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.",
"id": "GHSA-pqwq-mv6w-j3qf",
"modified": "2026-10-14T18:32:20Z",
"published": "2026-10-14T18:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101951"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA112187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RPFH-MGXM-C6HC
Vulnerability from github – Published: 2026-07-17 12:31 – Updated: 2026-07-17 12:31
VLAI
Details
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-15943"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-17T12:17:03Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.",
"id": "GHSA-rpfh-mgxm-c6hc",
"modified": "2026-07-17T12:31:30Z",
"published": "2026-07-17T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15943"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-15943"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501270"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VHFW-J3C3-CMGG
Vulnerability from github – Published: 2023-06-26 09:30 – Updated: 2024-04-04 05:09
VLAI
Details
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-1620"
],
"database_specific": {
"cwe_ids": [
"CWE-1288",
"CWE-20"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T07:15:09Z",
"severity": "MODERATE"
},
"details": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.",
"id": "GHSA-vhfw-j3c3-cmgg",
"modified": "2024-04-04T05:09:45Z",
"published": "2023-06-26T09:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1620"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2023-006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W88X-J48X-P6WF
Vulnerability from github – Published: 2026-10-14 18:32 – Updated: 2026-10-14 18:32
VLAI
Details
An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-102047"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T17:17:59Z",
"severity": "HIGH"
},
"details": "An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.",
"id": "GHSA-w88x-j48x-p6wf",
"modified": "2026-10-14T18:32:24Z",
"published": "2026-10-14T18:32:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102047"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA112187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WCVJ-VPVW-9RR5
Vulnerability from github – Published: 2026-05-27 12:31 – Updated: 2026-08-05 18:31
VLAI
Summary
Keycloak Services has Improper Validation of Consistency within Input
Details
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Severity
4.2 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"last_affected": "26.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.4.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-9689"
],
"database_specific": {
"cwe_ids": [
"CWE-1288"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T18:54:49Z",
"nvd_published_at": "2026-05-27T12:17:15Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.",
"id": "GHSA-wcvj-vpvw-9rr5",
"modified": "2026-08-05T18:31:20Z",
"published": "2026-05-27T12:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9689"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/49430"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/49959"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/18832bcae5bebd5a1d66c2ec5fcd640e576fa625"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/1f58a4b79a258bcf2ef86b58fbf0016cdb91291f"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/267a1a33d4dc1eac7622614ba9772b4e1e35726f"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50846"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50847"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50848"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50849"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-9689"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481845"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Services has Improper Validation of Consistency within Input"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
No CAPEC attack patterns related to this CWE.