CWE-20 · Improper Input Validation (page 29)
Page 29 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20255 | Medium | 5.3 | 2023-11-01 | A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… |
CVE-2023-20063 | High | 8.2 | 2023-11-01 | A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that ar… |
CVE-2023-20270 | Medium | 5.8 | 2023-11-01 | A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Def… |
CVE-2023-20114 | Medium | 6.5 | 2023-11-01 | A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to download arbi… |
CVE-2023-40062 | High | 8.0 | 2023-11-01 | SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user… |
CVE-2023-40061 | High | 8.8 | 2023-11-01 | Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. |
CVE-2022-48459 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48458 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48457 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2023-4197 | High | 7.5 | 2023-11-01 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker… |
CVE-2023-37833 | Low | 2.7 | 2023-10-31 | Improper access control in Elenos ETG150 FM transmitter v3.12 allows attackers to make arbitrary configuration edits that are only accessed by privileged users. |
CVE-2023-3955 | High | 8.8 | 2023-10-31 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes… |
CVE-2023-3676 | High | 8.8 | 2023-10-31 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes… |
CVE-2023-21391 | High | 7.5 | 2023-10-30 | In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with n… |
CVE-2022-4574 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute… |
CVE-2022-4573 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbit… |
CVE-2022-48189 | Medium | 6.7 | 2023-10-30 | An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute a… |
CVE-2023-5832 | Critical | 9.1 | 2023-10-30 | Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. |
CVE-2023-42431 | Low | 2.1 | 2023-10-30 | Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialo… |
CVE-2023-46289 | High | 7.5 | 2023-10-27 | Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data brin… |
CVE-2022-3429 | Medium | 6.5 | 2023-10-27 | A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering… |
CVE-2023-5624 | High | 7.2 | 2023-10-26 | Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that c… |
CVE-2023-5044 | High | 7.6 | 2023-10-25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. |
CVE-2023-5043 | High | 7.6 | 2023-10-25 | Ingress nginx annotation injection causes arbitrary command execution. |
CVE-2022-4886 | High | 8.8 | 2023-10-25 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive. |
CVE-2021-26736 | Medium | 6.7 | 2023-10-23 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged… |
CVE-2023-45805 | High | 7.8 | 2023-10-20 | pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an… |
CVE-2023-39456 | High | 7.5 | 2023-10-17 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2… |
CVE-2021-29913 | Medium | 6.5 | 2023-10-17 | IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to imprope… |
CVE-2022-22384 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Fo… |
CVE-2023-40373 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table exp… |
CVE-2023-40372 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External… |
CVE-2023-38719 | Medium | 5.1 | 2023-10-17 | IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607. |
CVE-2023-40374 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Forc… |
CVE-2023-30991 | High | 7.5 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force… |
CVE-2023-38740 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-For… |
CVE-2023-38728 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query st… |
CVE-2023-45128 | Critical | 10.0 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-38720 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE stateme… |
CVE-2023-30987 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-5421 | Low | 3.5 | 2023-10-16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScrip… |
CVE-2023-45176 | Medium | 6.2 | 2023-10-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of s… |
CVE-2023-29464 | High | 8.2 | 2023-10-13 | FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Se… |
CVE-2023-5571 | High | 7.5 | 2023-10-13 | Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-26367 | Medium | 4.9 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input… |
CVE-2023-44204 | Medium | 6.5 | 2023-10-13 | An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2023-44192 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to c… |
CVE-2023-44185 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS )to t… |
CVE-2023-44183 | Medium | 6.5 | 2023-10-13 | An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices a… |
CVE-2023-32721 | High | 7.6 | 2023-10-12 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
CVE-2023-44110 | Medium | 4.3 | 2023-10-11 | Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-44103 | High | 7.5 | 2023-10-11 | Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-36731 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36707 | Medium | 6.5 | 2023-10-10 | Windows Deployment Services Denial of Service Vulnerability |
CVE-2023-36706 | Medium | 6.5 | 2023-10-10 | Windows Deployment Services Information Disclosure Vulnerability |
CVE-2023-36697 | Medium | 6.8 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36585 | High | 7.5 | 2023-10-10 | Windows upnphost.dll Denial of Service Vulnerability |
CVE-2023-36566 | Medium | 6.5 | 2023-10-10 | Microsoft Common Data Model SDK Denial of Service Vulnerability |
CVE-2023-36563 | Medium | 6.5 | 2023-10-10 | Microsoft WordPad Information Disclosure Vulnerability |
CVE-2023-35349 | Critical | 9.8 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-32485 | Critical | 9.8 | 2023-10-05 | Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this… |
CVE-2023-43073 | Medium | 4.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. An authenticated remote atta… |
CVE-2023-43799 | Medium | 5.0 | 2023-10-04 | Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the un… |
CVE-2023-36619 | Critical | 9.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users. |
CVE-2023-42449 | High | 8.1 | 2023-10-04 | Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs fo… |
CVE-2023-42448 | High | 8.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTx… |
CVE-2023-39191 | High | 8.2 | 2023-10-04 | An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers… |
CVE-2023-38701 | Critical | 9.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `… |
CVE-2023-22515 | Critical | 9.8 | 2023-10-04 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in… |
CVE-2023-4586 | High | 7.4 | 2023-10-04 | A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly… |
CVE-2023-30690 | High | 8.5 | 2023-10-04 | Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-42508 | Medium | 6.5 | 2023-10-03 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users be… |
CVE-2023-24853 | High | 8.4 | 2023-10-03 | Memory Corruption in HLOS while registering for key provisioning notify. |
CVE-2023-22382 | High | 7.4 | 2023-10-03 | Weak configuration in Automotive while VM is processing a listener request from TEE. |
CVE-2023-3770 | Medium | 5.3 | 2023-10-02 | Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the di… |
CVE-2023-3769 | High | 8.6 | 2023-10-02 | Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to… |
CVE-2023-3768 | High | 8.6 | 2023-10-02 | Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to… |
CVE-2023-32827 | Medium | 6.7 | 2023-10-02 | In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System e… |
CVE-2023-32826 | Medium | 6.7 | 2023-10-02 | In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System e… |
CVE-2023-32820 | High | 7.5 | 2023-10-02 | In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional executi… |
CVE-2023-20231 | High | 8.8 | 2023-09-27 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device… |
CVE-2023-2315 | High | 8.1 | 2023-09-27 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary fi… |
CVE-2023-41303 | High | 7.5 | 2023-09-25 | Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure… |
CVE-2023-41300 | High | 7.5 | 2023-09-25 | Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2022-48605 | Critical | 9.8 | 2023-09-25 | Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availabil… |
CVE-2023-5143 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some un… |
CVE-2023-42798 | High | 8.2 | 2023-09-22 | AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job re… |
CVE-2023-42805 | High | 7.5 | 2023-09-21 | quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result… |
CVE-2023-4753 | Low | 3.9 | 2023-09-21 | OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input. |
CVE-2023-5104 | Medium | 6.5 | 2023-09-21 | Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0. |
CVE-2023-31013 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31012 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31011 | Medium | 5.2 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31010 | Medium | 6.8 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-31009 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31008 | High | 7.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25534 | Medium | 5.7 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25533 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability m… |
CVE-2023-25530 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |