CWE-20 · Improper Input Validation (page 21)
Page 21 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54100 | Medium | 6.2 | 2024-12-12 | Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnorma… |
CVE-2024-12401 | Medium | 4.4 | 2024-12-12 | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resour… |
CVE-2024-49087 | Medium | 4.6 | 2024-12-12 | Windows Mobile Broadband Driver Information Disclosure Vulnerability |
CVE-2024-49073 | Medium | 6.8 | 2024-12-12 | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability |
CVE-2024-49057 | High | 8.1 | 2024-12-12 | Microsoft Defender for Endpoint on Android Spoofing Vulnerability |
CVE-2024-11737 | Critical | 9.8 | 2024-12-11 | CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when a… |
CVE-2024-55655 | | 2024-12-10 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insu… | |
CVE-2024-55653 | Medium | 6.5 | 2024-12-10 | PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `Unhandle… |
CVE-2024-52831 | Low | 3.5 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2024-43755 | Low | 3.5 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2024-52982 | High | 7.8 | 2024-12-10 | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-52051 | High | 7.3 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V1… |
CVE-2024-45761 | Medium | 5.4 | 2024-12-09 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user… |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2024-12355 | Low | 3.3 | 2024-12-09 | A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function… |
CVE-2024-12353 | Low | 3.3 | 2024-12-09 | A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserIn… |
CVE-2024-54140 | | 2024-12-05 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundl… | |
CVE-2024-12138 | Medium | 6.3 | 2024-12-04 | A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimburs… |
CVE-2024-11985 | Medium | 4.4 | 2024-12-04 | An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Improper Input Validati… |
CVE-2024-52815 | Medium | 5.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability all… |
CVE-2024-43052 | High | 7.8 | 2024-12-02 | Memory corruption while processing API calls to NPU with invalid input. |
CVE-2024-52337 | Medium | 5.5 | 2024-11-26 | A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequen… |
CVE-2024-22117 | Low | 2.2 | 2024-11-26 | When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementu… |
CVE-2017-15832 | High | 8.4 | 2024-11-26 | Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW |
CVE-2024-11662 | Medium | 6.3 | 2024-11-25 | A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_var… |
CVE-2024-11234 | Medium | 4.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI i… |
CVE-2024-9257 | Medium | 6.5 | 2024-11-22 | Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to de… |
CVE-2024-52802 | High | 7.5 | 2024-11-22 | RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/applicati… |
CVE-2021-30299 | Medium | 6.7 | 2024-11-22 | Possible out of bound access in audio module due to lack of validation of user provided input. |
CVE-2024-52309 | | 2024-11-21 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo… | |
CVE-2024-9875 | High | 7.1 | 2024-11-21 | Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature… |
CVE-2024-45422 | Medium | 6.5 | 2024-11-19 | Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2021-1465 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory tra… |
CVE-2021-1462 | Medium | 6.7 | 2024-11-18 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To e… |
CVE-2020-3538 | Medium | 4.6 | 2024-11-18 | A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perfo… |
CVE-2024-0793 | High | 7.7 | 2024-11-17 | A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes… |
CVE-2021-34752 | Medium | 6.7 | 2024-11-15 | A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands… |
CVE-2021-1482 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorizati… |
CVE-2021-1470 | Medium | 4.9 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL inject… |
CVE-2021-1466 | Medium | 5.4 | 2024-11-15 | A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affe… |
CVE-2021-1464 | Medium | 5.0 | 2024-11-15 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access… |
CVE-2022-2232 | High | 7.5 | 2024-11-14 | A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other… |
CVE-2024-50305 | High | 7.5 | 2024-11-14 | Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users… |
CVE-2024-38479 | High | 7.5 | 2024-11-14 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-41167 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privi… |
CVE-2024-39811 | Medium | 6.3 | 2024-11-13 | Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-37027 | Medium | 6.1 | 2024-11-13 | Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of… |
CVE-2024-36482 | High | 8.2 | 2024-11-13 | Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-36284 | Medium | 5.5 | 2024-11-13 | Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2024-36282 | High | 8.2 | 2024-11-13 | Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged user to potentially… |
CVE-2024-33624 | Medium | 4.3 | 2024-11-13 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user to potentially ena… |
CVE-2024-33611 | Low | 3.4 | 2024-11-13 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to potentially enable de… |
CVE-2024-32485 | Low | 3.9 | 2024-11-13 | Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to potentially enable denial of service via… |
CVE-2024-32048 | Medium | 6.5 | 2024-11-13 | Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticated user to potenti… |
CVE-2024-31158 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to potentially enable escalation of privile… |
CVE-2024-31154 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentially enable escalation of privilege via loc… |
CVE-2024-28049 | Medium | 5.7 | 2024-11-13 | Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow… |
CVE-2024-28028 | High | 7.5 | 2024-11-13 | Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of… |
CVE-2024-24984 | Medium | 6.5 | 2024-11-13 | Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated user to potentially en… |
CVE-2024-23198 | Medium | 6.6 | 2024-11-13 | Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unaut… |
CVE-2024-8936 | Medium | 6.5 | 2024-11-13 | CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle att… |
CVE-2024-49033 | High | 7.5 | 2024-11-12 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2024-21976 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21975 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21974 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21949 | Medium | 5.5 | 2024-11-12 | Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to system crash. |
CVE-2024-10944 | High | 8.4 | 2024-11-12 | A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input v… |
CVE-2024-50386 | High | 8.5 | 2024-11-12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due t… |
CVE-2024-39281 | Medium | 5.3 | 2024-11-12 | The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. |
CVE-2024-37365 | High | 7.3 | 2024-11-12 | A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyo… |
CVE-2024-50560 | Low | 3.1 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50557 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-11079 | Medium | 5.5 | 2024-11-12 | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute t… |
CVE-2024-23983 | | 2024-11-11 | Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. | |
CVE-2024-52286 | | 2024-11-11 | Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes… | |
CVE-2023-1973 | High | 7.5 | 2024-11-07 | A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, le… |
CVE-2024-50343 | Low | 3.1 | 2024-11-06 | symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a r… |
CVE-2024-20484 | High | 7.5 | 2024-11-06 | A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacke… |
CVE-2024-50333 | Medium | 6.6 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the fil… |
CVE-2024-49774 | High | 7.2 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods… |
CVE-2024-51530 | Medium | 6.6 | 2024-11-05 | LaunchAnywhere vulnerability in the account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-51529 | Medium | 5.5 | 2024-11-05 | Data verification vulnerability in the battery module Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2024-51520 | Medium | 5.5 | 2024-11-05 | Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51519 | Medium | 5.0 | 2024-11-05 | Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51514 | Medium | 5.3 | 2024-11-05 | Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-51512 | Medium | 6.2 | 2024-11-05 | Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51511 | Medium | 6.2 | 2024-11-05 | Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-33031 | Medium | 6.7 | 2024-11-04 | Memory corruption while processing the update SIM PB records request. |
CVE-2024-23386 | Medium | 6.7 | 2024-11-04 | memory corruption when WiFi display APIs are invoked with large random inputs. |
CVE-2024-33700 | High | 7.5 | 2024-10-30 | The LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackers to cause a denial… |
CVE-2024-22065 | Medium | 6.8 | 2024-10-29 | There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated att… |
CVE-2024-45802 | High | 7.5 | 2024-10-28 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected… |
CVE-2024-0127 | High | 7.8 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can caus… |
CVE-2024-0126 | High | 8.2 | 2024-10-26 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit… |
CVE-2024-49753 | Medium | 5.9 | 2024-10-25 | Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL va… |
CVE-2024-20495 | High | 8.6 | 2024-10-23 | A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2024-20274 | Medium | 5.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-48919 | | 2024-10-22 | Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature… | |
CVE-2024-49368 | Critical | 9.8 | 2024-10-21 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and… |
CVE-2024-49361 | | 2024-10-18 | ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in… |