CWE-1284 · Improper Validation of Specified Quantity in Input (page 4)
Page 4 of 4 — CVEs classified under CWE-1284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26047 | Medium | 4.3 | 2022-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potent… |
CVE-2022-36938 | Critical | 9.8 | 2022-11-11 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially a… |
CVE-2022-20445 | High | 7.5 | 2022-11-08 | In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote informati… |
CVE-2022-39294 | High | 7.5 | 2022-10-31 | conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length bef… |
CVE-2022-39313 | High | 7.5 | 2022-10-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5… |
CVE-2022-39272 | Medium | 5.0 | 2022-10-22 | Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permis… |
CVE-2022-2592 | Medium | 6.5 | 2022-10-17 | A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allow… |
CVE-2022-36063 | High | 7.6 | 2022-10-10 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–su… |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-40761 | High | 7.5 | 2022-09-16 | The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Alloca… |
CVE-2022-2277 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a deni… |
CVE-2022-20385 | Critical | 9.8 | 2022-09-13 | a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is… |
CVE-2022-36086 | High | 8.4 | 2022-09-07 | linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for… |
CVE-2022-36078 | High | 8.8 | 2022-09-02 | Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices i… |
CVE-2021-35132 | High | 8.4 | 2022-09-02 | Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2022-28199 | Medium | 6.5 | 2022-09-01 | NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly… |
CVE-2022-36620 | High | 7.5 | 2022-08-31 | D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. |
CVE-2022-21208 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single sessio… |
CVE-2022-37134 | Critical | 9.8 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and th… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2022-2845 | High | 7.8 | 2022-08-17 | Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. |
CVE-2022-25793 | High | 7.8 | 2022-08-10 | A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the le… |
CVE-2022-35928 | High | 8.4 | 2022-08-03 | AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a v… |
CVE-2021-45918 | High | 7.5 | 2022-06-20 | NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remo… |
CVE-2022-22072 | High | 7.8 | 2022-06-14 | Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electron… |
CVE-2021-30350 | High | 8.4 | 2022-06-14 | Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29200 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell`… |
CVE-2022-29196 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropF… |
CVE-2021-26347 | Medium | 4.7 | 2022-05-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2022-24903 | High | 8.1 | 2022-05-06 | Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used… |
CVE-2022-28613 | High | 7.5 | 2022-05-02 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attac… |
CVE-2021-21943 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execut… |
CVE-2022-1174 | Medium | 4.3 | 2022-04-04 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting… |
CVE-2021-39690 | Medium | 5.5 | 2022-03-16 | In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. This could lead to lo… |
CVE-2022-24754 | High | 8.5 | 2022-03-11 | PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer o… |
CVE-2022-26128 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld… |
CVE-2022-26127 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babe… |
CVE-2022-26125 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-25375 | Medium | 5.5 | 2022-02-20 | An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RND… |
CVE-2022-23319 | Medium | 5.5 | 2022-02-17 | A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. Th… |
CVE-2022-0596 | Medium | 4.3 | 2022-02-15 | Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0214 | High | 7.5 | 2022-02-14 | The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is no… |
CVE-2022-20699 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2021-46158 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack ba… |
CVE-2022-23580 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controll… |
CVE-2021-21960 | Critical | 10.0 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted netwo… |
CVE-2022-0414 | Medium | 4.3 | 2022-01-31 | Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. |
CVE-2022-22166 | Medium | 6.5 | 2022-01-19 | An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an unauthenticated… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2022-0174 | Medium | 4.3 | 2022-01-10 | Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. |
CVE-2021-44158 | High | 8.0 | 2022-01-03 | ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authenticated local area netw… |
CVE-2021-45972 | High | 7.1 | 2022-01-01 | The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. T… |
CVE-2021-45462 | High | 7.5 | 2021-12-23 | In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF. |
CVE-2021-21951 | Critical | 10.0 | 2021-12-08 | An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6… |
CVE-2021-21950 | Critical | 10.0 | 2021-12-08 | An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6… |
CVE-2021-31346 | High | 8.2 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-31345 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTR… |
CVE-2021-43267 | Critical | 9.8 | 2021-11-02 | An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote… |
CVE-2021-3581 | High | 7.0 | 2021-10-05 | Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805). For more informati… |
CVE-2021-39193 | Medium | 5.3 | 2021-09-03 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause inv… |
CVE-2021-37677 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerab… |
CVE-2021-37674 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a segmentation faul… |
CVE-2021-31556 | Critical | 9.8 | 2021-08-12 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key wil… |
CVE-2021-1083 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1082 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to informatio… |
CVE-2021-1081 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input length is not validated… |
CVE-2021-1062 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering of data or denial… |
CVE-2021-1058 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, which may lead to… |
CVE-2020-27217 | High | 7.5 | 2020-11-13 | In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may… |
CVE-2013-0270 | Medium | 6.5 | 2013-04-12 | A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long te… |
CVE-2010-3904 | High | 7.8 | 2010-12-06 | The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not pro… |
CVE-2009-4488 | Critical | 9.8 | 2010-01-13 | Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly… |
CVE-2008-2374 | Critical | 9.8 | 2008-07-07 | src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP pac… |
CVE-2008-1440 | | 2008-06-12 | Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets… |