CWE-1284 · Improper Validation of Specified Quantity in Input (page 4)
Page 4 of 5 — CVEs classified under CWE-1284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42448 | High | 8.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTx… |
CVE-2023-42447 | High | 8.6 | 2023-09-19 | blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representin… |
CVE-2023-42444 | High | 8.6 | 2023-09-19 | phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumb… |
CVE-2023-4439 | Medium | 4.3 | 2023-08-20 | A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-38744 | High | 7.5 | 2023-08-03 | Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2… |
CVE-2021-46893 | High | 7.5 | 2023-07-05 | Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity. |
CVE-2023-35932 | High | 7.1 | 2023-06-23 | jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered b… |
CVE-2023-34188 | High | 7.5 | 2023-06-23 | The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker c… |
CVE-2023-30082 | High | 7.5 | 2023-06-14 | A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket… |
CVE-2023-25731 | High | 8.8 | 2023-06-02 | Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in… |
CVE-2022-47029 | High | 7.8 | 2023-05-30 | An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update. |
CVE-2023-21111 | Medium | 5.5 | 2023-05-15 | In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input validation. This c… |
CVE-2023-20722 | Medium | 6.7 | 2023-05-15 | In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20710 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20709 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20708 | Medium | 6.7 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20707 | Medium | 6.7 | 2023-05-15 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20705 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-20704 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-27961 | Medium | 5.5 | 2023-05-08 | Multiple validation issues were addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and… |
CVE-2023-27941 | Medium | 5.5 | 2023-05-08 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6… |
CVE-2023-30269 | High | 8.1 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php. |
CVE-2023-0195 | Low | 2.0 | 2023-04-01 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284, which may lead to hyp… |
CVE-2023-0194 | Low | 2.0 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer driver, where an invalid display configuration may lead to de… |
CVE-2022-4904 | High | 8.6 | 2023-03-06 | A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary lengt… |
CVE-2022-3411 | Medium | 6.5 | 2023-02-13 | A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated… |
CVE-2023-23626 | Medium | 5.9 | 2023-02-09 | go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the… |
CVE-2022-48298 | High | 7.5 | 2023-02-09 | The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access. |
CVE-2022-48297 | High | 7.5 | 2023-02-09 | The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bo… |
CVE-2022-20493 | High | 7.8 | 2023-01-26 | In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to local escalation of p… |
CVE-2021-28510 | Medium | 5.3 | 2023-01-26 | For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PT… |
CVE-2023-22409 | Medium | 5.5 | 2023-01-13 | An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to… |
CVE-2022-37312 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. |
CVE-2022-37311 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. |
CVE-2022-20543 | Low | 2.3 | 2022-12-16 | In multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service with system executio… |
CVE-2022-4171 | Medium | 6.5 | 2022-12-13 | The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin impr… |
CVE-2022-46143 | Low | 2.7 | 2022-12-13 | Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially co… |
CVE-2022-20491 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20488 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2021-44693 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-0934 | Medium | 5.5 | 2022-12-13 | In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no a… |
CVE-2022-20691 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjac… |
CVE-2022-20690 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20689 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20688 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote… |
CVE-2022-20687 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-20686 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-4111 | Medium | 6.5 | 2022-11-22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB. |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41877 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious… |
CVE-2022-25727 | Critical | 9.8 | 2022-11-15 | Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Mus… |
CVE-2022-26047 | Medium | 4.3 | 2022-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potent… |
CVE-2022-36938 | Critical | 9.8 | 2022-11-11 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially a… |
CVE-2022-20445 | High | 7.5 | 2022-11-08 | In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote informati… |
CVE-2022-39294 | High | 7.5 | 2022-10-31 | conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length bef… |
CVE-2022-39313 | High | 7.5 | 2022-10-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5… |
CVE-2022-39272 | Medium | 5.0 | 2022-10-22 | Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permis… |
CVE-2022-2592 | Medium | 6.5 | 2022-10-17 | A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allow… |
CVE-2022-36063 | High | 7.6 | 2022-10-10 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–su… |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-40761 | High | 7.5 | 2022-09-16 | The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Alloca… |
CVE-2022-2277 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a deni… |
CVE-2022-20385 | Critical | 9.8 | 2022-09-13 | a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is… |
CVE-2022-36086 | High | 8.4 | 2022-09-07 | linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for… |
CVE-2022-36078 | High | 8.8 | 2022-09-02 | Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices i… |
CVE-2021-35132 | High | 8.4 | 2022-09-02 | Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2022-28199 | Medium | 6.5 | 2022-09-01 | NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly… |
CVE-2022-36620 | High | 7.5 | 2022-08-31 | D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. |
CVE-2022-21208 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single sessio… |
CVE-2022-37134 | Critical | 9.8 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and th… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2022-2845 | High | 7.8 | 2022-08-17 | Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. |
CVE-2022-25793 | High | 7.8 | 2022-08-10 | A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the le… |
CVE-2022-35928 | High | 8.4 | 2022-08-03 | AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a v… |
CVE-2021-45918 | High | 7.5 | 2022-06-20 | NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remo… |
CVE-2022-22072 | High | 7.8 | 2022-06-14 | Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electron… |
CVE-2021-30350 | High | 8.4 | 2022-06-14 | Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29200 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell`… |
CVE-2022-29196 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropF… |
CVE-2021-26347 | Medium | 4.7 | 2022-05-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2022-24903 | High | 8.1 | 2022-05-06 | Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used… |
CVE-2022-28613 | High | 7.5 | 2022-05-02 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attac… |
CVE-2021-21943 | High | 8.8 | 2022-04-14 | A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execut… |
CVE-2022-1174 | Medium | 4.3 | 2022-04-04 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting… |
CVE-2021-39690 | Medium | 5.5 | 2022-03-16 | In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. This could lead to lo… |
CVE-2022-24754 | High | 8.5 | 2022-03-11 | PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer o… |
CVE-2022-26128 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld… |
CVE-2022-26127 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babe… |
CVE-2022-26125 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-25375 | Medium | 5.5 | 2022-02-20 | An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RND… |
CVE-2022-23319 | Medium | 5.5 | 2022-02-17 | A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. Th… |
CVE-2022-0596 | Medium | 4.3 | 2022-02-15 | Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0214 | High | 7.5 | 2022-02-14 | The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is no… |
CVE-2022-20699 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2021-46158 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a stack ba… |
CVE-2022-23580 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controll… |
CVE-2021-21960 | Critical | 10.0 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted netwo… |