CWE-20 · Improper Input Validation (page 30)
Page 30 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32649 | High | 7.5 | 2023-09-19 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence… |
CVE-2023-4680 | Medium | 6.8 | 2023-09-15 | HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The… |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-3710 | Critical | 9.9 | 2023-09-12 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p… |
CVE-2023-39208 | Medium | 6.5 | 2023-09-12 | Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network… |
CVE-2023-38156 | High | 7.2 | 2023-09-12 | Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability |
CVE-2023-36767 | Medium | 4.3 | 2023-09-12 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2023-36762 | High | 7.3 | 2023-09-12 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2023-36761 | Medium | 6.5 | 2023-09-12 | Microsoft Word Information Disclosure Vulnerability |
CVE-2023-29332 | High | 7.5 | 2023-09-12 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
CVE-2023-2071 | Critical | 9.8 | 2023-09-12 | Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve… |
CVE-2022-24093 | Critical | 9.1 | 2023-09-12 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issu… |
CVE-2023-41336 | Medium | 6.5 | 2023-09-11 | ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an… |
CVE-2023-41316 | Medium | 5.5 | 2023-09-07 | Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. R… |
CVE-2023-41061 | High | 7.8 | 2023-09-07 | A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may… |
CVE-2023-39265 | Low | 3.8 | 2023-09-06 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or… |
CVE-2021-36021 | High | 7.2 | 2023-09-06 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS… |
CVE-2023-30712 | Medium | 6.8 | 2023-09-06 | Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity. |
CVE-2023-39357 | High | 8.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeri… |
CVE-2015-2202 | High | 7.2 | 2023-09-05 | Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS. |
CVE-2023-34317 | Medium | 6.5 | 2023-09-05 | An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A special… |
CVE-2023-40743 | Critical | 9.8 | 2023-09-05 | ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFact… |
CVE-2022-43903 | Medium | 4.3 | 2023-09-05 | IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation. IBM X-Force… |
CVE-2023-32811 | Medium | 6.7 | 2023-09-04 | In connectivity system driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2023-33914 | High | 7.5 | 2023-09-04 | In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no addit… |
CVE-2022-47353 | Medium | 4.4 | 2023-09-04 | In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges n… |
CVE-2023-4698 | High | 7.5 | 2023-09-01 | Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4481 | High | 7.5 | 2023-09-01 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, ne… |
CVE-2023-41748 | Critical | 9.8 | 2023-08-31 | Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203. |
CVE-2023-41746 | Critical | 9.8 | 2023-08-31 | Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203. |
CVE-2023-39137 | High | 7.8 | 2023-08-30 | An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. |
CVE-2023-26095 | High | 7.5 | 2023-08-28 | ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet. |
CVE-2023-27604 | High | 8.8 | 2023-08-28 | Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes… |
CVE-2023-40798 | High | 8.8 | 2023-08-25 | In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentic… |
CVE-2023-40797 | High | 8.8 | 2023-08-25 | In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow… |
CVE-2023-40801 | High | 8.8 | 2023-08-25 | The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn |
CVE-2023-40800 | High | 8.8 | 2023-08-25 | The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda A… |
CVE-2023-3705 | High | 7.5 | 2023-08-24 | The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated rem… |
CVE-2023-3704 | Medium | 5.3 | 2023-08-24 | The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthentica… |
CVE-2023-20169 | High | 7.4 | 2023-08-23 | A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco N… |
CVE-2023-20168 | High | 7.1 | 2023-08-23 | A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenticated, local attacker to cause an affected device… |
CVE-2023-25915 | Critical | 9.9 | 2023-08-21 | Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system. |
CVE-2023-36674 | Medium | 5.3 | 2023-08-20 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to byp… |
CVE-2023-4435 | Medium | 5.5 | 2023-08-20 | Improper Input Validation in GitHub repository hamza417/inure prior to build88. |
CVE-2023-40165 | High | 7.4 | 2023-08-17 | rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem… |
CVE-2023-2917 | Critical | 9.8 | 2023-08-17 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversa… |
CVE-2023-2915 | High | 7.5 | 2023-08-17 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vu… |
CVE-2023-2914 | High | 7.5 | 2023-08-17 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected… |
CVE-2023-40272 | High | 7.5 | 2023-08-17 | Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing… |
CVE-2023-20232 | Medium | 5.3 | 2023-08-16 | A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a… |
CVE-2023-40034 | High | 8.1 | 2023-08-16 | Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the reposito… |
CVE-2023-38737 | Medium | 5.9 | 2023-08-16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remo… |
CVE-2023-4241 | High | 7.5 | 2023-08-16 | lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected. |
CVE-2023-20564 | Medium | 6.7 | 2023-08-15 | Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/w… |
CVE-2023-20560 | Medium | 4.4 | 2023-08-15 | Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value… |
CVE-2023-4357 | High | 8.8 | 2023-08-15 | Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a cr… |
CVE-2023-21284 | Medium | 5.5 | 2023-08-14 | In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation. Thi… |
CVE-2023-21272 | High | 7.8 | 2023-08-14 | In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with n… |
CVE-2023-39950 | Medium | 6.1 | 2023-08-14 | efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and… |
CVE-2023-39404 | High | 7.5 | 2023-08-13 | Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the devi… |
CVE-2023-39390 | High | 7.5 | 2023-08-13 | Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the devi… |
CVE-2023-39386 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps t… |
CVE-2023-39405 | Critical | 9.8 | 2023-08-13 | Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with… |
CVE-2023-39389 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailabi… |
CVE-2023-39388 | High | 7.5 | 2023-08-13 | Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause home screen unavailabi… |
CVE-2023-39382 | High | 7.5 | 2023-08-13 | Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to restart. |
CVE-2023-39381 | High | 7.5 | 2023-08-13 | Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-39553 | High | 7.5 | 2023-08-11 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerabil… |
CVE-2023-34086 | High | 8.2 | 2023-08-11 | Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-32617 | High | 8.2 | 2023-08-11 | Improper input validation in some Intel(R) NUC Rugged Kit, Intel(R) NUC Kit and Intel(R) Compute Element BIOS firmware may allow a privileged user to potential… |
CVE-2023-29494 | High | 7.5 | 2023-08-11 | Improper input validation in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-26587 | High | 7.8 | 2023-08-11 | Improper input validation for the Intel(R) Easy Streaming Wizard software may allow an authenticated user to potentially enable escalation of privilege via loc… |
CVE-2023-22449 | High | 7.5 | 2023-08-11 | Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-44611 | Medium | 6.9 | 2023-08-11 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjac… |
CVE-2022-38102 | High | 7.2 | 2023-08-11 | Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged us… |
CVE-2022-38076 | Low | 3.8 | 2023-08-11 | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation o… |
CVE-2022-37336 | High | 7.9 | 2023-08-11 | Improper input validation in BIOS firmware for some Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-36392 | High | 8.6 | 2023-08-11 | Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70… |
CVE-2022-36351 | Medium | 4.3 | 2023-08-11 | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of… |
CVE-2022-34657 | Medium | 6.0 | 2023-08-11 | Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information discl… |
CVE-2023-32560 | Critical | 9.8 | 2023-08-10 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Than… |
CVE-2022-47185 | High | 7.5 | 2023-08-09 | Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: throu… |
CVE-2023-39209 | Medium | 5.9 | 2023-08-08 | Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network acce… |
CVE-2023-36899 | High | 8.8 | 2023-08-08 | ASP.NET Elevation of Privilege Vulnerability |
CVE-2023-36873 | High | 7.4 | 2023-08-08 | .NET Framework Spoofing Vulnerability |
CVE-2023-3894 | Medium | 5.8 | 2023-08-08 | Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2023-38254 | Medium | 6.5 | 2023-08-08 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36912 | High | 7.5 | 2023-08-08 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36897 | High | 8.1 | 2023-08-08 | Visual Studio Tools for Office Runtime Spoofing Vulnerability |
CVE-2023-36893 | Medium | 6.5 | 2023-08-08 | Microsoft Outlook Spoofing Vulnerability |
CVE-2023-35377 | Medium | 6.5 | 2023-08-08 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-35376 | Medium | 6.5 | 2023-08-08 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-35368 | High | 8.8 | 2023-08-08 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2023-39532 | Critical | 9.8 | 2023-08-08 | SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 prior to 0.17.1, 0… |
CVE-2023-21647 | Medium | 6.5 | 2023-08-08 | Information disclosure in Bluetooth when an GATT packet is received due to improper input validation. |
CVE-2023-21627 | Medium | 6.7 | 2023-08-08 | Memory corruption in Trusted Execution Environment while calling service API with invalid address. |
CVE-2023-39530 | Medium | 6.5 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Ve… |
CVE-2023-39529 | Medium | 6.7 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments contr… |
CVE-2023-38704 | High | 8.1 | 2023-08-07 | import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the… |
CVE-2023-27373 | Medium | 5.5 | 2023-08-07 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible… |