CWE-20 · Improper Input Validation (page 23)
Page 23 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41856 | High | 7.8 | 2024-08-14 | Illustrator versions 28.5, 27.9.4, 28.6, 27.9.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code exec… |
CVE-2024-34118 | Medium | 5.5 | 2024-08-14 | Illustrator versions 28.5, 27.9.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application denial-of-service co… |
CVE-2024-34163 | High | 7.5 | 2024-08-14 | Improper input validation in firmware for some Intel(R) NUC may allow a privileged user to potentially enableescalation of privilege via local access. |
CVE-2024-28947 | High | 8.2 | 2024-08-14 | Improper input validation in kernel mode driver for some Intel(R) Server Board S2600ST Family firmware before version 02.01.0017 may allow a privileged user to… |
CVE-2024-24973 | Low | 2.2 | 2024-08-14 | Improper input validation for some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial… |
CVE-2024-21810 | High | 8.8 | 2024-08-14 | Improper input validation in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenti… |
CVE-2023-34424 | Medium | 4.4 | 2024-08-14 | Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access. |
CVE-2024-38483 | Medium | 5.8 | 2024-08-14 | Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentia… |
CVE-2024-37373 | High | 7.2 | 2024-08-14 | Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE. |
CVE-2024-38201 | High | 7.0 | 2024-08-13 | Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2024-38196 | High | 7.8 | 2024-08-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2024-38189 | High | 8.8 | 2024-08-13 | Microsoft Project Remote Code Execution Vulnerability |
CVE-2023-31366 | Low | 3.3 | 2024-08-13 | Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service. |
CVE-2023-31339 | Medium | 4.8 | 2024-08-13 | Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads… |
CVE-2022-23817 | High | 7.0 | 2024-08-13 | Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to read/write to the… |
CVE-2024-41976 | High | 7.2 | 2024-08-13 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-41940 | Critical | 9.1 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command… |
CVE-2024-7512 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The… |
CVE-2024-30188 | High | 8.1 | 2024-08-12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache D… |
CVE-2024-29831 | High | 8.8 | 2024-08-12 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-24062 | Medium | 6.8 | 2024-08-08 | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root fi… |
CVE-2024-6254 | Medium | 4.3 | 2024-08-08 | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing o… |
CVE-2024-7005 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-7004 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-23483 | High | 7.0 | 2024-08-06 | An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on Mac… |
CVE-2024-6915 | Critical | 9.3 | 2024-08-05 | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could p… |
CVE-2024-21978 | Medium | 6.0 | 2024-08-05 | Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruptio… |
CVE-2024-40721 | High | 8.8 | 2024-08-02 | The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofe… |
CVE-2024-40720 | High | 8.8 | 2024-08-02 | The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofe… |
CVE-2024-38879 | High | 7.5 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (… |
CVE-2024-42458 | Critical | 9.8 | 2024-08-02 | server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369. |
CVE-2024-4353 | Medium | 4.8 | 2024-08-01 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input fie… |
CVE-2024-23600 | Low | 2.7 | 2024-08-01 | Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing appr… |
CVE-2023-1577 | High | 7.8 | 2024-07-31 | A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated… |
CVE-2017-3772 | Medium | 5.5 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot. |
CVE-2024-6978 | Medium | 5.6 | 2024-07-31 | Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28. |
CVE-2024-6973 | High | 7.5 | 2024-07-31 | Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34. |
CVE-2024-7340 | High | 8.8 | 2024-07-31 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak a… |
CVE-2024-39950 | High | 8.6 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device in… |
CVE-2024-39949 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39948 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39944 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to… |
CVE-2024-41945 | Low | 3.1 | 2024-07-30 | fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silen… |
CVE-2024-5969 | Medium | 5.8 | 2024-07-27 | The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This i… |
CVE-2024-41120 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41119 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41117 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41116 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41115 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-41114 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-41113 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41112 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable i… |
CVE-2024-35296 | High | 8.2 | 2024-07-26 | Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: f… |
CVE-2024-25090 | Medium | 5.4 | 2024-07-26 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Rol… |
CVE-2024-3938 | Medium | 5.4 | 2024-07-25 | The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrate… |
CVE-2024-29068 | Medium | 5.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so ca… |
CVE-2024-41839 | Low | 3.5 | 2024-07-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-7014 | High | 8.1 | 2024-07-23 | EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. |
CVE-2024-32007 | High | 7.5 | 2024-07-19 | An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service a… |
CVE-2024-40642 | High | 8.1 | 2024-07-18 | The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly validate input value… |
CVE-2024-23469 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user… |
CVE-2024-3173 | High | 8.8 | 2024-07-16 | Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malici… |
CVE-2024-3172 | High | 8.8 | 2024-07-16 | Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2023-7012 | Critical | 9.6 | 2024-07-16 | Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app… |
CVE-2024-6089 | High | 7.5 | 2024-07-16 | An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to resu… |
CVE-2024-39827 | Medium | 5.5 | 2024-07-15 | Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial… |
CVE-2024-27241 | Medium | 5.3 | 2024-07-15 | Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27240 | High | 7.1 | 2024-07-15 | Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access. |
CVE-2024-40520 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data i… |
CVE-2024-40518 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into w… |
CVE-2024-5681 | High | 7.8 | 2024-07-11 | CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a… |
CVE-2024-39513 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows a local, low-privileged attacker t… |
CVE-2024-39511 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the 802.1X Authentication (dot1x) Daemon of Juniper Networks Junos OS allows a local, low-privileged attacker wit… |
CVE-2024-5913 | Medium | 6.1 | 2024-07-10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system t… |
CVE-2024-31310 | High | 7.8 | 2024-07-09 | In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill service settings du… |
CVE-2024-27386 | Medium | 6.7 | 2024-07-09 | A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input val… |
CVE-2024-27385 | Medium | 6.7 | 2024-07-09 | A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input val… |
CVE-2024-38105 | Medium | 6.5 | 2024-07-09 | Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability |
CVE-2024-38095 | High | 7.5 | 2024-07-09 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-38055 | Medium | 5.5 | 2024-07-09 | Microsoft Windows Codecs Library Information Disclosure Vulnerability |
CVE-2024-38052 | High | 7.8 | 2024-07-09 | Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38047 | High | 7.8 | 2024-07-09 | PowerShell Elevation of Privilege Vulnerability |
CVE-2024-38043 | High | 7.8 | 2024-07-09 | PowerShell Elevation of Privilege Vulnerability |
CVE-2024-38033 | High | 7.3 | 2024-07-09 | PowerShell Elevation of Privilege Vulnerability |
CVE-2024-38021 | High | 8.8 | 2024-07-09 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-22271 | High | 8.2 | 2024-07-09 | In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose… |
CVE-2024-35227 | High | 7.5 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing… |
CVE-2024-32755 | Critical | 9.1 | 2024-07-02 | Under certain circumstances the web interface will accept characters unrelated to the expected input. |
CVE-2023-41917 | Critical | 10.0 | 2024-07-02 | Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell comm… |
CVE-2024-0158 | Medium | 5.1 | 2024-07-02 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2024-39573 | High | 7.5 | 2024-07-01 | Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handle… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2024-38525 | High | 7.5 | 2024-06-28 | dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited… |
CVE-2024-30110 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system… |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-5990 | High | 7.5 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ an… |
CVE-2024-5989 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote c… |
CVE-2024-5988 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote cod… |
CVE-2024-21519 | Medium | 6.6 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality… |
CVE-2024-6239 | High | 7.5 | 2024-06-21 | A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files… |