CWE-235 - Improper Handling of Extra Parameters

Home/CWEs/CWE info/

CWE-235

Abstraction:
Variant

Structure:
Simple

Status:
Draft

Weakness Name: Improper Handling of Extra Parameters

Description: The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Common Consequences: Scope: Integrity
Impact: Unexpected State

Related Weaknesses: CWE-233Improper Handling of Parameters

Release Date:
2006-07-19

Latest Modification Date:
2023-06-29

Latest Security News

Joint Advisory Warns of PRC-Backed Cyber Espionage Targeting Telecom Networks

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access

Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defenses

Cloudflare’s developer domains increasingly abused by threat actors

Veeam warns of critical RCE bug in Service Provider Console

Veeam plugs serious holes in Service Provider Console (CVE-2024-42448, CVE-2024-42449)

Top Alert List

MediumDirectory Browsing

MediumAbsence of Anti-CSRF Tokens

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

Content Security Policy (CSP) Header Not Set

InformationalModern Web Application

LowServer Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

CSP

InformationalNon-Storable Content

LowCookie without SameSite Attribute

LowCross-Domain JavaScript Source File Inclusion

Top CVE List

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XEE) Reference Vulnerability

CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2024-11680 ProjectSend Improper Authentication Vulnerability

CVE-2009-1151 phpMyAdmin Remote Code Execution Vulnerability

CVE-2015-2360 Microsoft Win32k Privilege Escalation Vulnerability

CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability

CVE-2021-26086 Atlassian Jira Server and Data Center Path Traversal Vulnerability

CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability

Top CWE List

CWE-15 External Control of System or Configuration Setting

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-1395 Dependency on Vulnerable Third-Party Component

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1426 Improper Validation of Generative AI Output

MediumCWE-190 Integer Overflow or Wraparound

CWE-236 Improper Handling of Undefined Parameters

CWE-328 Use of Weak Hash

Free security scan for your website

Don't show website scan report rating on the leaderboard

CWE-235 - Improper Handling of Extra Parameters

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.