CWE-20 · Improper Input Validation (page 25)
Page 25 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32371 | High | 7.5 | 2024-05-07 | An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain administrative acces… |
CVE-2023-7240 | Medium | 5.8 | 2024-05-07 | An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open se… |
CVE-2024-21476 | High | 7.8 | 2024-05-06 | Memory corruption when the channel ID passed by user is not validated and further used. |
CVE-2024-4548 | Critical | 9.8 | 2024-05-06 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into… |
CVE-2024-4547 | Critical | 9.8 | 2024-05-06 | A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted int… |
CVE-2024-20064 | High | 7.8 | 2024-05-06 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional… |
CVE-2024-20056 | Medium | 6.7 | 2024-05-06 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execut… |
CVE-2024-34473 | Medium | 5.3 | 2024-05-04 | An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt… |
CVE-2024-33792 | Critical | 9.8 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page. |
CVE-2023-40515 | High | 7.5 | 2024-05-03 | LG Simple Editor joinAddUser Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-servic… |
CVE-2023-32170 | Medium | 6.5 | 2024-05-03 | Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a de… |
CVE-2024-4003 | Medium | 6.4 | 2024-05-02 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-3747 | Medium | 6.4 | 2024-05-02 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and inclu… |
CVE-2024-2867 | Medium | 6.4 | 2024-05-02 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-2751 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_style’ parameter in a… |
CVE-2024-25290 | High | 8.0 | 2024-05-02 | An issue in Casa Systems NL1901ACV R6B032 allows a remote attacker to execute arbitrary code via the userName parameter of the add function. |
CVE-2024-0710 | Medium | 5.3 | 2024-05-02 | The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input va… |
CVE-2024-31965 | Medium | 4.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-4142 | Critical | 9.0 | 2024-05-01 | An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability… |
CVE-2024-23335 | Medium | 4.7 | 2024-05-01 | MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted… |
CVE-2024-3096 | Medium | 6.5 | 2024-04-29 | In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing… |
CVE-2024-2756 | Medium | 6.5 | 2024-04-29 | Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure coo… |
CVE-2024-32646 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double ev… |
CVE-2024-32645 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` built… |
CVE-2024-28240 | High | 7.3 | 2024-04-25 | The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cau… |
CVE-2024-4175 | Medium | 5.4 | 2024-04-25 | Unicode transformation vulnerability in Hyperion affecting version 2.0.15. This vulnerability could allow an attacker to send a malicious payload with Unicode… |
CVE-2024-25583 | High | 7.5 | 2024-04-25 | A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default co… |
CVE-2024-28977 | Low | 3.3 | 2024-04-24 | Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could pote… |
CVE-2024-28976 | High | 8.8 | 2024-04-24 | Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially… |
CVE-2024-3177 | Low | 2.7 | 2024-04-22 | A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAcco… |
CVE-2024-32653 | Medium | 6.1 | 2024-04-22 | jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary co… |
CVE-2023-38293 | High | 7.3 | 2024-04-22 | Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus… |
CVE-2024-31841 | High | 7.5 | 2024-04-19 | An issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary file… |
CVE-2024-3646 | High | 8.0 | 2024-04-19 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2023-5397 | High | 8.1 | 2024-04-17 | Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell… |
CVE-2023-36505 | Medium | 6.8 | 2024-04-17 | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. |
CVE-2024-3841 | Medium | 6.1 | 2024-04-17 | Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged… |
CVE-2022-24806 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an I… |
CVE-2024-3029 | High | 8.0 | 2024-04-16 | In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoin… |
CVE-2024-3028 | High | 7.2 | 2024-04-16 | mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the… |
CVE-2024-3493 | High | 8.6 | 2024-04-15 | A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major n… |
CVE-2024-2424 | High | 7.5 | 2024-04-15 | An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonrecoverable fault (… |
CVE-2024-29838 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker… |
CVE-2024-21590 | Medium | 5.3 | 2024-04-12 | An Improper Input Validation vulnerability in Juniper Tunnel Driver (jtd) and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attack… |
CVE-2024-29461 | Medium | 6.3 | 2024-04-12 | An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component. |
CVE-2024-3400 | Critical | 10.0 | 2024-04-12 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS… |
CVE-2024-30916 | High | 7.1 | 2024-04-11 | An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensitive information vi… |
CVE-2024-1481 | Medium | 5.3 | 2024-04-10 | A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kin… |
CVE-2024-3385 | High | 7.5 | 2024-04-10 | A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually c… |
CVE-2024-3101 | High | 7.2 | 2024-04-10 | In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending… |
CVE-2024-31309 | High | 7.5 | 2024-04-10 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2024-20758 | Critical | 9.0 | 2024-04-10 | Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in a… |
CVE-2024-21507 | Medium | 6.5 | 2024-04-10 | Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An at… |
CVE-2024-2650 | Medium | 6.4 | 2024-04-09 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-2536 | Medium | 6.4 | 2024-04-09 | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all versions up to, and… |
CVE-2024-2513 | Medium | 6.4 | 2024-04-09 | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6… |
CVE-2024-2226 | Medium | 6.4 | 2024-04-09 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id param… |
CVE-2024-2165 | Medium | 6.4 | 2024-04-09 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including… |
CVE-2024-2027 | Medium | 6.4 | 2024-04-09 | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all v… |
CVE-2024-25116 | Medium | 5.5 | 2024-04-09 | RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use t… |
CVE-2024-31867 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP s… |
CVE-2024-28897 | Medium | 6.8 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-26253 | Medium | 6.8 | 2024-04-09 | Windows rndismp6.sys Remote Code Execution Vulnerability |
CVE-2024-26240 | High | 8.0 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-26189 | High | 8.0 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-20670 | High | 8.1 | 2024-04-09 | Outlook for Windows Spoofing Vulnerability |
CVE-2024-31865 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook… |
CVE-2024-31862 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0… |
CVE-2022-47894 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, w… |
CVE-2024-27896 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity. |
CVE-2023-52385 | Medium | 6.2 | 2024-04-08 | Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52552 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the power module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52535 | Medium | 4.4 | 2024-04-08 | In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges nee… |
CVE-2024-27912 | High | 7.5 | 2024-04-05 | A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending crafted LPD packets. |
CVE-2024-27909 | Medium | 4.9 | 2024-04-05 | A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot. |
CVE-2024-0080 | Low | 2.8 | 2024-04-05 | NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input… |
CVE-2023-31028 | Low | 2.8 | 2024-04-05 | NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted i… |
CVE-2024-31212 | Medium | 6.7 | 2024-04-04 | InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrati… |
CVE-2024-29008 | Medium | 6.4 | 2024-04-04 | A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a… |
CVE-2024-2689 | Medium | 4.4 | 2024-04-03 | Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows an… |
CVE-2024-20334 | Medium | 5.5 | 2024-04-03 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a c… |
CVE-2024-27201 | Medium | 4.9 | 2024-04-03 | An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A sp… |
CVE-2024-27254 | Medium | 5.3 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially cra… |
CVE-2024-25046 | Medium | 5.3 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially… |
CVE-2024-22360 | Medium | 5.3 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar… |
CVE-2023-52296 | Medium | 5.3 | 2024-04-03 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concur… |
CVE-2024-29074 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper input. |
CVE-2024-28226 | High | 8.1 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input. |
CVE-2024-21473 | Critical | 9.8 | 2024-04-01 | Memory corruption while redirecting log file to any file location with any file name. |
CVE-2024-21453 | High | 7.5 | 2024-04-01 | Transient DOS while decoding message of size that exceeds the available system memory. |
CVE-2024-21452 | High | 7.3 | 2024-04-01 | Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions. |
CVE-2023-33100 | High | 7.5 | 2024-04-01 | Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification. |
CVE-2023-33099 | High | 7.5 | 2024-04-01 | Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR. |
CVE-2024-29946 | High | 8.1 | 2024-03-27 | In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypa… |
CVE-2024-20271 | High | 8.6 | 2024-03-27 | A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (D… |
CVE-2023-29134 | High | 8.6 | 2024-03-27 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit. |
CVE-2023-46047 | High | 7.3 | 2024-03-27 | An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed be… |
CVE-2024-23482 | High | 7.0 | 2024-03-26 | The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and lat… |
CVE-2024-2427 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets… |
CVE-2024-2426 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption… |