CWE-20 · Improper Input Validation (page 27)
Page 27 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1247 | Low | 2.0 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data… |
CVE-2024-22119 | Medium | 5.5 | 2024-02-09 | The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. |
CVE-2024-0955 | Medium | 4.8 | 2024-02-07 | A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy set… |
CVE-2024-24941 | Medium | 6.1 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL |
CVE-2023-33057 | High | 7.5 | 2024-02-06 | Transient DOS in Multi-Mode Call Processor while processing UE policy container. |
CVE-2023-47355 | High | 7.5 | 2024-02-05 | The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for PowerOff, Reboot, a… |
CVE-2024-20004 | High | 7.5 | 2024-02-05 | In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Conn… |
CVE-2024-20003 | High | 7.5 | 2024-02-05 | In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Conn… |
CVE-2024-21863 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-0285 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2023-46159 | Low | 2.6 | 2024-02-02 | IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906. |
CVE-2023-49610 | High | 8.1 | 2024-02-01 | MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a message ru… |
CVE-2024-21388 | Medium | 6.5 | 2024-01-30 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-1019 | High | 8.6 | 2024-01-30 | ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 d… |
CVE-2023-4553 | Medium | 5.3 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. AppBuilder configuration files are viewable by un… |
CVE-2023-4552 | Medium | 5.5 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability… |
CVE-2023-4551 | High | 7.2 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that fa… |
CVE-2023-4550 | High | 7.5 | 2024-01-29 | Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files… |
CVE-2024-23790 | Low | 3.5 | 2024-01-29 | Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue… |
CVE-2024-23655 | High | 7.5 | 2024-01-25 | Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the use… |
CVE-2024-23641 | High | 7.5 | 2024-01-24 | SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request wit… |
CVE-2024-23842 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22772 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22771 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22770 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22769 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22768 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-23678 | High | 7.5 | 2024-01-22 | In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe dese… |
CVE-2024-23676 | Medium | 4.6 | 2024-01-22 | In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to vie… |
CVE-2023-47141 | Medium | 5.3 | 2024-01-22 | IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service… |
CVE-2023-47747 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-47158 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a… |
CVE-2023-50308 | Medium | 6.5 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a… |
CVE-2023-47746 | Medium | 5.3 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-45193 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-50694 | Critical | 9.8 | 2024-01-19 | An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim compo… |
CVE-2023-42766 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2023-38587 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-29495 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28743 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28738 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-48354 | Medium | 5.5 | 2024-01-18 | In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges ne… |
CVE-2023-48346 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible improper input validation. This could lead to local denial of service with no additional execution privileges needed |
CVE-2024-0396 | High | 7.1 | 2024-01-17 | In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue… |
CVE-2023-5097 | High | 7.0 | 2024-01-16 | Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7. |
CVE-2024-0507 | Medium | 6.5 | 2024-01-16 | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Ma… |
CVE-2023-6395 | Medium | 6.7 | 2024-01-16 | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with ro… |
CVE-2024-20721 | Medium | 5.5 | 2024-01-15 | Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could… |
CVE-2024-20709 | Medium | 5.5 | 2024-01-15 | Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could… |
CVE-2023-31035 | High | 7.5 | 2024-01-12 | NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM… |
CVE-2023-49568 | High | 7.5 | 2024-01-12 | A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service at… |
CVE-2024-22027 | Medium | 6.5 | 2024-01-12 | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (… |
CVE-2024-22199 | Critical | 9.3 | 2024-01-11 | This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specificall… |
CVE-2023-6781 | Medium | 6.4 | 2024-01-11 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and includin… |
CVE-2023-45171 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. IBM X-Force ID… |
CVE-2023-45169 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service… |
CVE-2023-45175 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service… |
CVE-2023-45173 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IB… |
CVE-2023-42826 | High | 7.8 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution. |
CVE-2023-40394 | Low | 3.3 | 2024-01-10 | The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensit… |
CVE-2023-29446 | Medium | 4.7 | 2024-01-10 | An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an… |
CVE-2023-41781 | Medium | 5.7 | 2024-01-10 | There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be trig… |
CVE-2024-21319 | Medium | 6.8 | 2024-01-09 | Microsoft Identity Denial of service vulnerability |
CVE-2024-21316 | Medium | 6.1 | 2024-01-09 | Windows Server Key Distribution Service Security Feature Bypass |
CVE-2024-21312 | High | 7.5 | 2024-01-09 | .NET Framework Denial of Service Vulnerability |
CVE-2024-20666 | Medium | 6.6 | 2024-01-09 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-0057 | Critical | 9.1 | 2024-01-09 | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
CVE-2024-22165 | Medium | 6.5 | 2024-01-09 | In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malfor… |
CVE-2023-51438 | Critical | 10.0 | 2024-01-09 | A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions… |
CVE-2023-49252 | High | 7.5 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to… |
CVE-2024-21663 | Critical | 9.9 | 2024-01-09 | Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerabl… |
CVE-2023-41782 | Low | 3.9 | 2024-01-05 | There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vuln… |
CVE-2024-21625 | High | 8.8 | 2024-01-04 | SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest… |
CVE-2023-6992 | Medium | 4.0 | 2024-01-04 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The iss… |
CVE-2023-6738 | Medium | 5.4 | 2024-01-04 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code'… |
CVE-2023-50256 | High | 7.5 | 2024-01-03 | Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such… |
CVE-2023-46929 | High | 7.5 | 2024-01-03 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers… |
CVE-2024-21631 | Medium | 6.5 | 2024-01-03 | Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's compon… |
CVE-2023-49551 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file. |
CVE-2024-21627 | High | 8.1 | 2024-01-02 | PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Som… |
CVE-2023-33014 | High | 7.6 | 2024-01-02 | Information disclosure in Core services while processing a Diag command. |
CVE-2023-26159 | High | 7.3 | 2024-01-02 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() func… |
CVE-2023-32890 | High | 7.5 | 2024-01-02 | In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2023-49299 | High | 8.8 | 2023-12-30 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-52137 | High | 7.7 | 2023-12-29 | The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing… |
CVE-2023-47804 | High | 8.8 | 2023-12-29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-7163 | Critical | 10.0 | 2023-12-28 | A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could… |
CVE-2023-6879 | Critical | 9.0 | 2023-12-27 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
CVE-2023-31455 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. |
CVE-2023-31289 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. |
CVE-2023-39251 | Medium | 6.7 | 2023-12-22 | Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in ord… |
CVE-2023-45165 | Medium | 6.2 | 2023-12-22 | IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 26… |
CVE-2023-6784 | Medium | 4.7 | 2023-12-20 | A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. |
CVE-2023-0011 | High | 7.6 | 2023-12-20 | A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerabili… |
CVE-2023-47705 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID… |
CVE-2023-47161 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leadin… |
CVE-2023-42012 | Medium | 6.2 | 2023-12-20 | An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a deni… |
CVE-2023-45172 | Medium | 6.2 | 2023-12-19 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. IBM X-Force ID… |
CVE-2023-22439 | Low | 3.1 | 2023-12-18 | Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perfor… |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |