CWE-20 · Improper Input Validation (page 24)
Page 24 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38359 | Medium | 6.5 | 2024-06-20 | The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead… |
CVE-2024-37346 | Medium | 4.9 | 2024-06-20 | There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrato… |
CVE-2024-34693 | Medium | 6.8 | 2024-06-20 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If b… |
CVE-2024-38355 | High | 7.3 | 2024-06-19 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught excep… |
CVE-2024-4787 | Medium | 5.8 | 2024-06-19 | The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to i… |
CVE-2024-5533 | Medium | 6.4 | 2024-06-18 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization a… |
CVE-2024-37794 | High | 7.5 | 2024-06-17 | Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. |
CVE-2024-32907 | High | 7.8 | 2024-06-13 | In memcall_add of memlog.c, there is a possible buffer overflow due to improper input validation. This could lead to local escalation of privilege with no addi… |
CVE-2024-32903 | High | 7.8 | 2024-06-13 | In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation… |
CVE-2024-32860 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-32859 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-32858 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-32856 | Medium | 5.1 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-34109 | High | 7.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitra… |
CVE-2024-34108 | Critical | 9.1 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitra… |
CVE-2024-36226 | Low | 3.5 | 2024-06-13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2024-26127 | Low | 3.5 | 2024-06-13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2024-26126 | Low | 3.5 | 2024-06-13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2024-30087 | High | 7.8 | 2024-06-11 | Win32k Elevation of Privilege Vulnerability |
CVE-2024-30078 | High | 8.8 | 2024-06-11 | Windows Wi-Fi Driver Remote Code Execution Vulnerability |
CVE-2024-35212 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application lacks input validation due t… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-27805 | Medium | 5.5 | 2024-06-10 | An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS… |
CVE-2024-31959 | High | 8.4 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can res… |
CVE-2024-36740 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size. |
CVE-2024-36734 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the dim parame… |
CVE-2024-36745 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.index_select parame… |
CVE-2024-36737 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.fu… |
CVE-2024-36742 | High | 7.5 | 2024-06-06 | An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index parameter exceeds the r… |
CVE-2024-5171 | Critical | 9.8 | 2024-06-05 | Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_… |
CVE-2024-27378 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_c… |
CVE-2024-20405 | Medium | 4.8 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploi… |
CVE-2024-5439 | Medium | 6.4 | 2024-06-05 | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due t… |
CVE-2024-23669 | Medium | 6.5 | 2024-06-05 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-28103 | Medium | 5.4 | 2024-06-04 | Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on response… |
CVE-2022-1242 | High | 7.8 | 2024-06-03 | Apport can be tricked into connecting to arbitrary sockets as the root user |
CVE-2024-23668 | High | 8.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-36390 | High | 7.5 | 2024-06-02 | MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service |
CVE-2024-5138 | High | 8.1 | 2024-05-31 | The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fo… |
CVE-2024-34009 | High | 7.5 | 2024-05-31 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is u… |
CVE-2024-33999 | Critical | 9.8 | 2024-05-31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly. |
CVE-2024-33996 | Medium | 6.2 | 2024-05-31 | Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have p… |
CVE-2024-22338 | Medium | 4.0 | 2024-05-31 | IBM Security Verify Access OIDC Provider 22.09 through 23.03 could disclose sensitive information to a local user due to hazardous input validation. IBM X-For… |
CVE-2024-3584 | High | 7.5 | 2024-05-30 | qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By man… |
CVE-2024-3657 | High | 7.5 | 2024-05-28 | A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service |
CVE-2024-2199 | Medium | 5.7 | 2024-05-28 | A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `use… |
CVE-2024-35384 | Medium | 5.5 | 2024-05-21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file. |
CVE-2024-4287 | High | 7.2 | 2024-05-20 | In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to… |
CVE-2024-36053 | Critical | 9.0 | 2024-05-19 | In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_… |
CVE-2021-22508 | High | 7.2 | 2024-05-17 | A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries… |
CVE-2024-22429 | High | 7.5 | 2024-05-17 | Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulner… |
CVE-2024-22120 | Critical | 9.1 | 2024-05-17 | Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is… |
CVE-2024-24981 | High | 7.5 | 2024-05-16 | Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged user to enable escal… |
CVE-2024-23487 | High | 7.5 | 2024-05-16 | Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enabl… |
CVE-2024-22476 | Critical | 10.0 | 2024-05-16 | Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation o… |
CVE-2024-22390 | Medium | 4.4 | 2024-05-16 | Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service. |
CVE-2024-22382 | High | 7.5 | 2024-05-16 | Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escala… |
CVE-2024-22095 | High | 7.2 | 2024-05-16 | Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to ena… |
CVE-2024-22015 | Medium | 6.5 | 2024-05-16 | Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local… |
CVE-2023-48368 | Medium | 5.9 | 2024-05-16 | Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2023-47855 | Medium | 6.0 | 2024-05-16 | Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of pri… |
CVE-2023-47210 | Medium | 4.7 | 2024-05-16 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enabl… |
CVE-2023-45745 | High | 7.9 | 2024-05-16 | Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of pri… |
CVE-2023-43745 | Low | 2.8 | 2024-05-16 | Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2023-38654 | High | 8.2 | 2024-05-16 | Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentiall… |
CVE-2023-38417 | Medium | 4.3 | 2024-05-16 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial o… |
CVE-2023-28402 | High | 7.2 | 2024-05-16 | Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-22662 | Medium | 5.8 | 2024-05-16 | Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user to potentially enabl… |
CVE-2024-4609 | Critical | 9.8 | 2024-05-16 | A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if… |
CVE-2024-4321 | High | 7.5 | 2024-05-16 | A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat histo… |
CVE-2024-25743 | High | 7.1 | 2024-05-15 | In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler… |
CVE-2024-20394 | Medium | 5.5 | 2024-05-15 | A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an… |
CVE-2024-3968 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task. |
CVE-2024-3488 | Medium | 5.6 | 2024-05-15 | File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file withou… |
CVE-2024-2248 | Medium | 6.4 | 2024-05-15 | A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end us… |
CVE-2024-34098 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code e… |
CVE-2021-22280 | High | 7.2 | 2024-05-14 | Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of t… |
CVE-2024-3676 | High | 7.5 | 2024-05-14 | The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remot… |
CVE-2024-30054 | Medium | 6.5 | 2024-05-14 | Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability |
CVE-2024-30040 | High | 8.8 | 2024-05-14 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2024-30002 | Medium | 6.8 | 2024-05-14 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-29998 | Medium | 6.8 | 2024-05-14 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-3372 | High | 7.5 | 2024-05-14 | Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause u… |
CVE-2024-25970 | Medium | 6.5 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially ex… |
CVE-2024-34365 | Critical | 9.1 | 2024-05-14 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this pro… |
CVE-2024-32992 | High | 7.5 | 2024-05-14 | Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32990 | Medium | 6.1 | 2024-05-14 | Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32989 | Low | 3.3 | 2024-05-14 | Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32672 | Medium | 5.3 | 2024-05-14 | A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted in… |
CVE-2024-32669 | Medium | 5.3 | 2024-05-14 | Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and doe… |
CVE-2024-30258 | High | 8.2 | 2024-05-14 | FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4… |
CVE-2024-2257 | Critical | 9.1 | 2024-05-14 | This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to improper implementation of password policies… |
CVE-2024-25641 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through th… |
CVE-2024-25581 | High | 7.5 | 2024-05-14 | When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigg… |
CVE-2024-2746 | High | 8.8 | 2024-05-08 | Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged u… |
CVE-2024-1929 | High | 7.5 | 2024-05-08 | Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configu… |
CVE-2024-23707 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2024-23706 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privil… |
CVE-2024-23705 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalatio… |
CVE-2024-0022 | Medium | 5.5 | 2024-05-07 | In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to i… |