CWE-20 · Improper Input Validation (page 26)
Page 26 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2425 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web serve… |
CVE-2024-29042 | Medium | 5.3 | 2024-03-22 | Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the… |
CVE-2024-27932 | Medium | 4.6 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifi… |
CVE-2024-27918 | High | 8.2 | 2024-03-21 | Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OI… |
CVE-2024-2469 | High | 8.0 | 2024-03-20 | An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Ent… |
CVE-2024-2443 | Critical | 9.1 | 2024-03-20 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2023-45177 | Medium | 5.3 | 2024-03-20 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD is vulnerable to a denial-of-service attack due to an error within the MQ clustering logic. IBM X-Force I… |
CVE-2024-23634 | Medium | 6.0 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exist… |
CVE-2023-51444 | High | 7.2 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists… |
CVE-2024-24683 | Medium | 6.5 | 2024-03-19 | Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2… |
CVE-2024-25942 | Medium | 4.4 | 2024-03-19 | Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially expl… |
CVE-2024-28855 | High | 8.1 | 2024-03-18 | ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the… |
CVE-2024-25656 | Medium | 5.9 | 2024-03-18 | Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) devic… |
CVE-2023-7248 | Medium | 5.0 | 2024-03-15 | Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s… |
CVE-2023-7060 | High | 8.6 | 2024-03-15 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination add… |
CVE-2023-32633 | Medium | 6.7 | 2024-03-14 | Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of… |
CVE-2024-20327 | High | 7.4 | 2024-03-13 | A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allo… |
CVE-2024-20318 | High | 7.4 | 2024-03-13 | A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network proc… |
CVE-2024-24549 | High | 7.5 | 2024-03-13 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceed… |
CVE-2024-1854 | Medium | 6.4 | 2024-03-13 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId pa… |
CVE-2024-0161 | High | 7.2 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacke… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-27135 | High | 8.5 | 2024-03-12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out… |
CVE-2024-26197 | Medium | 6.5 | 2024-03-12 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
CVE-2024-26181 | Medium | 5.5 | 2024-03-12 | Windows Kernel Denial of Service Vulnerability |
CVE-2024-26173 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26170 | High | 7.8 | 2024-03-12 | Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability |
CVE-2024-26164 | High | 8.8 | 2024-03-12 | Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability |
CVE-2024-21448 | Medium | 5.0 | 2024-03-12 | Microsoft Teams for Android Information Disclosure Vulnerability |
CVE-2024-26002 | High | 7.8 | 2024-03-12 | An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. |
CVE-2024-25999 | High | 8.4 | 2024-03-12 | An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. |
CVE-2024-25997 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. |
CVE-2024-25995 | Critical | 9.8 | 2024-03-12 | An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input valid… |
CVE-2024-23717 | High | 8.8 | 2024-03-11 | In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead… |
CVE-2024-0045 | Medium | 6.5 | 2024-03-11 | In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) infor… |
CVE-2024-2339 | High | 8.0 | 2024-03-08 | PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a co… |
CVE-2024-27613 | High | 7.3 | 2024-03-08 | Numbas editor before 7.3 mishandles reading of themes and extensions. |
CVE-2024-27612 | Medium | 6.2 | 2024-03-08 | Numbas editor before 7.3 mishandles editing of themes and extensions. |
CVE-2024-23294 | High | 7.8 | 2024-03-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4. Processing malicious input may lead to code execution. |
CVE-2024-23263 | Medium | 6.5 | 2024-03-08 | A logic issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma… |
CVE-2024-23246 | High | 8.6 | 2024-03-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvO… |
CVE-2023-42661 | High | 7.2 | 2024-03-07 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specia… |
CVE-2024-1534 | Medium | 6.4 | 2024-03-07 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and includin… |
CVE-2024-27931 | Medium | 5.8 | 2024-03-05 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for… |
CVE-2023-33104 | High | 7.5 | 2024-03-04 | Transient DOS while processing PDU Release command with a parameter PDU ID out of range. |
CVE-2023-33103 | High | 7.5 | 2024-03-04 | Transient DOS while processing CAG info IE received from NW. |
CVE-2023-28578 | Critical | 9.3 | 2024-03-04 | Memory corruption in Core Services while executing the command for removing a single event listener. |
CVE-2024-20034 | High | 7.2 | 2024-03-04 | In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2024-20017 | Critical | 9.8 | 2024-03-04 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional executio… |
CVE-2024-25016 | High | 7.5 | 2024-03-03 | IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffe… |
CVE-2024-27092 | Medium | 5.4 | 2024-02-29 | Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Co… |
CVE-2023-44345 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a Improper Input Validation vulnerability. An unauthenticated attacker… |
CVE-2023-50737 | Critical | 9.1 | 2024-02-28 | The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to e… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2024-27093 | Medium | 4.6 | 2024-02-26 | Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or d… |
CVE-2024-27447 | Critical | 9.8 | 2024-02-26 | pretix before 2024.1.1 mishandles file validation. |
CVE-2021-33161 | High | 7.2 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potent… |
CVE-2021-33146 | Medium | 5.3 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to… |
CVE-2021-33142 | Medium | 6.0 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potent… |
CVE-2021-33141 | High | 8.6 | 2024-02-23 | Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to… |
CVE-2024-23320 | High | 8.8 | 2024-02-23 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-26151 | High | 8.2 | 2024-02-22 | The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All u… |
CVE-2024-1714 | High | 7.1 | 2024-02-21 | An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitesp… |
CVE-2024-22054 | High | 7.5 | 2024-02-20 | A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discov… |
CVE-2024-25974 | Medium | 5.4 | 2024-02-20 | The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenO… |
CVE-2024-25973 | Medium | 5.4 | 2024-02-20 | The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can c… |
CVE-2024-1638 | High | 8.2 | 2024-02-19 | The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission… |
CVE-2023-52372 | High | 7.5 | 2024-02-18 | Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52368 | Medium | 5.3 | 2024-02-18 | Input verification vulnerability in the account module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-0021 | High | 7.8 | 2024-02-16 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due… |
CVE-2023-51931 | High | 7.5 | 2024-02-16 | An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function. |
CVE-2024-0031 | Critical | 9.8 | 2024-02-16 | In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote c… |
CVE-2023-6937 | Medium | 5.3 | 2024-02-15 | wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages usi… |
CVE-2024-20733 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application den… |
CVE-2023-32484 | Critical | 9.8 | 2024-02-15 | Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability. A remote unauthe… |
CVE-2023-32462 | Critical | 9.8 | 2024-02-15 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthe… |
CVE-2024-1471 | Medium | 5.9 | 2024-02-14 | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify R… |
CVE-2023-42776 | Low | 3.8 | 2024-02-14 | Improper input validation in some Intel(R) SGX DCAP software for Windows before version 1.19.100.3 may allow an authenticateed user to potentially enable infor… |
CVE-2023-34983 | Medium | 4.3 | 2024-02-14 | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to p… |
CVE-2023-28374 | Medium | 6.1 | 2024-02-14 | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to p… |
CVE-2023-25951 | Medium | 6.0 | 2024-02-14 | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow a privileged user to potenti… |
CVE-2023-24463 | Medium | 4.3 | 2024-02-14 | Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable in… |
CVE-2023-22342 | High | 7.7 | 2024-02-14 | Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable esca… |
CVE-2024-24696 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-24695 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-1378 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1374 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1372 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1369 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1359 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1355 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1354 | High | 8.0 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-21413 | Critical | 9.8 | 2024-02-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-21374 | Medium | 5.0 | 2024-02-13 | Microsoft Teams for Android Information Disclosure Vulnerability |
CVE-2024-21315 | High | 7.8 | 2024-02-13 | Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability |
CVE-2024-21304 | Medium | 4.1 | 2024-02-13 | Trusted Compute Base Elevation of Privilege Vulnerability |
CVE-2024-20684 | Medium | 6.5 | 2024-02-13 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-23324 | High | 8.6 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid… |
CVE-2024-1246 | Low | 2.0 | 2024-02-09 | Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided… |
CVE-2024-1245 | Low | 2.4 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not suf… |