CWE-20 · Improper Input Validation (page 22)
Page 22 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48918 | | 2024-10-16 | RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain a vulnerability that… | |
CVE-2024-9348 | | 2024-10-16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. | |
CVE-2024-45219 | High | 8.5 | 2024-10-16 | Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks… |
CVE-2024-48914 | Critical | 9.1 | 2024-10-15 | Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to… |
CVE-2024-6207 | High | 7.5 | 2024-10-14 | CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the… |
CVE-2024-8755 | High | 8.4 | 2024-10-11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affe… |
CVE-2024-9507 | Medium | 4.9 | 2024-10-11 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-45117 | High | 7.6 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbit… |
CVE-2024-47823 | Critical | 9.8 | 2024-10-08 | Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`… |
CVE-2024-43611 | High | 8.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-43593 | High | 8.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-43592 | High | 8.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-43561 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43558 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43557 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43542 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43540 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43538 | Medium | 6.5 | 2024-10-08 | Windows Mobile Broadband Driver Denial of Service Vulnerability |
CVE-2024-43526 | Medium | 6.8 | 2024-10-08 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-43525 | Medium | 6.8 | 2024-10-08 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-43523 | Medium | 6.8 | 2024-10-08 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-38265 | High | 8.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-38261 | High | 7.8 | 2024-10-08 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2024-30092 | High | 8.0 | 2024-10-08 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2024-20659 | High | 7.1 | 2024-10-08 | Windows Hyper-V Security Feature Bypass Vulnerability |
CVE-2024-8518 | Low | 3.3 | 2024-10-08 | CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted project file is loaded… |
CVE-2024-43697 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-31449 | High | 7.0 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overf… |
CVE-2024-31227 | Medium | 4.4 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-33066 | Critical | 9.8 | 2024-10-07 | Memory corruption while redirecting log file to any file location with any file name. |
CVE-2024-33065 | High | 8.4 | 2024-10-07 | Memory corruption while taking snapshot when an offset variable is set by camera driver. |
CVE-2024-45871 | Medium | 6.3 | 2024-10-03 | Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS). |
CVE-2024-25590 | High | 7.5 | 2024-10-03 | An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of s… |
CVE-2024-9407 | Medium | 4.7 | 2024-10-01 | A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this… |
CVE-2024-6436 | Medium | 6.5 | 2024-09-27 | An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the serve… |
CVE-2024-47175 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does… |
CVE-2024-47076 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2024-47179 | High | 8.8 | 2024-09-26 | RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could have lead to a ful… |
CVE-2024-20464 | High | 8.6 | 2024-09-25 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2024-7023 | High | 8.8 | 2024-09-23 | Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file… |
CVE-2024-46946 | Critical | 9.8 | 2024-09-19 | langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which… |
CVE-2024-37406 | High | 7.5 | 2024-09-18 | In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. |
CVE-2024-45601 | High | 7.5 | 2024-09-18 | Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially all… |
CVE-2024-8889 | Critical | 9.3 | 2024-09-18 | Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/passw… |
CVE-2024-45798 | Critical | 9.9 | 2024-09-17 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to m… |
CVE-2024-45612 | Medium | 5.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (fr… |
CVE-2024-45537 | Medium | 6.5 | 2024-09-17 | Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid… |
CVE-2024-34545 | Medium | 5.2 | 2024-09-16 | Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable information disclosure… |
CVE-2024-21871 | High | 7.5 | 2024-09-16 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2024-21829 | High | 7.5 | 2024-09-16 | Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege… |
CVE-2024-21781 | High | 7.2 | 2024-09-16 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or denial of service via l… |
CVE-2024-44094 | High | 7.8 | 2024-09-13 | In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible memory corruption due to improper input validation. This could lead to local escalation of priv… |
CVE-2024-6077 | High | 7.5 | 2024-09-12 | A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If ex… |
CVE-2024-6658 | High | 8.4 | 2024-09-12 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected… |
CVE-2024-45825 | High | 7.5 | 2024-09-12 | CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the… |
CVE-2024-20406 | High | 7.4 | 2024-09-11 | A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unau… |
CVE-2024-43455 | High | 8.8 | 2024-09-10 | Windows Remote Desktop Licensing Service Spoofing Vulnerability |
CVE-2024-38245 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38244 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38243 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38241 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38234 | Medium | 6.5 | 2024-09-10 | Windows Networking Denial of Service Vulnerability |
CVE-2024-38230 | Medium | 6.5 | 2024-09-10 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
CVE-2024-38216 | High | 8.2 | 2024-09-10 | Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2024-38194 | High | 8.4 | 2024-09-10 | An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network. |
CVE-2024-38046 | High | 7.8 | 2024-09-10 | PowerShell Elevation of Privilege Vulnerability |
CVE-2024-37965 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2024-42424 | Medium | 5.3 | 2024-09-10 | Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. A high privileged attacker with local access… |
CVE-2024-27366 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyn… |
CVE-2024-8445 | Medium | 5.7 | 2024-09-05 | The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash w… |
CVE-2024-44808 | Critical | 9.8 | 2024-09-04 | An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter. |
CVE-2024-45446 | Medium | 5.5 | 2024-09-04 | Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-45444 | Medium | 5.5 | 2024-09-04 | Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45441 | Medium | 6.2 | 2024-09-04 | Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-44809 | Critical | 9.8 | 2024-09-03 | A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. The issue arises from improper sanitization o… |
CVE-2024-38811 | High | 8.8 | 2024-09-03 | VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard… |
CVE-2024-23362 | High | 7.1 | 2024-09-02 | Cryptographic issue while parsing RSA keys in COBR format. |
CVE-2024-38303 | Medium | 5.3 | 2024-08-29 | Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local… |
CVE-2024-45058 | High | 8.1 | 2024-08-28 | i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 b… |
CVE-2024-41565 | Medium | 4.3 | 2024-08-28 | JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue i… |
CVE-2021-38122 | Medium | 6.2 | 2024-08-28 | A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This iss… |
CVE-2024-7988 | Critical | 9.8 | 2024-08-26 | A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with Syst… |
CVE-2024-8073 | Critical | 9.8 | 2024-08-26 | Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects… |
CVE-2024-45258 | Critical | 9.8 | 2024-08-25 | The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbag… |
CVE-2024-45236 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed ob… |
CVE-2024-42531 | Critical | 9.8 | 2024-08-23 | Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific se… |
CVE-2024-41849 | Medium | 4.1 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-45169 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45167 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-7980 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-7977 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a mal… |
CVE-2024-7974 | High | 8.8 | 2024-08-21 | Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted C… |
CVE-2024-33657 | High | 7.8 | 2024-08-21 | This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMR… |
CVE-2020-11850 | High | 7.3 | 2024-08-21 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Res… |
CVE-2024-25009 | Medium | 6.5 | 2024-08-20 | Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to den… |
CVE-2024-7646 | High | 8.8 | 2024-08-16 | A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group… |
CVE-2024-25008 | Medium | 6.8 | 2024-08-16 | Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code executi… |
CVE-2024-43373 | High | 7.7 | 2024-08-15 | webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted… |
CVE-2024-7515 | High | 7.5 | 2024-08-14 | CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fau… |
CVE-2024-7507 | Medium | 6.5 | 2024-08-14 | CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received… |