CWE-20 · Improper Input Validation (page 31)
Page 31 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26082 | Medium | 5.8 | 2023-08-04 | A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2023-38690 | Medium | 5.8 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly p… |
CVE-2023-30952 | Medium | 5.0 | 2023-08-03 | A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. T… |
CVE-2023-37559 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37558 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37556 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37555 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37554 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37553 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37552 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37550 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37549 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37548 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37547 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37546 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37545 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2022-4925 | Medium | 6.5 | 2023-07-29 | Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious n… |
CVE-2022-4911 | Medium | 6.5 | 2023-07-29 | Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2023-38495 | High | 8.3 | 2023-07-27 | Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's… |
CVE-2022-43713 | High | 7.5 | 2023-07-26 | Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypa… |
CVE-2023-28130 | High | 7.2 | 2023-07-26 | Local user may lead to privilege escalation using Gaia Portal hostnames page. |
CVE-2022-2502 | High | 7.5 | 2023-07-26 | A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited… |
CVE-2023-38502 | Medium | 6.5 | 2023-07-25 | TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested qu… |
CVE-2023-35944 | High | 8.2 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme… |
CVE-2023-38060 | Medium | 6.3 | 2023-07-24 | Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface m… |
CVE-2023-38057 | Medium | 4.1 | 2023-07-24 | An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript… |
CVE-2023-37915 | High | 7.5 | 2023-07-21 | OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while parsing a malformed `P… |
CVE-2023-3466 | High | 8.3 | 2023-07-19 | Reflected Cross-Site Scripting (XSS) |
CVE-2023-28513 | Medium | 5.9 | 2023-07-19 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vuln… |
CVE-2022-43908 | Medium | 4.3 | 2023-07-19 | IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903. |
CVE-2023-33832 | Medium | 6.2 | 2023-07-19 | IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functio… |
CVE-2023-3724 | Critical | 9.1 | 2023-07-17 | If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable… |
CVE-2023-36466 | Low | 3.5 | 2023-07-14 | Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for t… |
CVE-2023-36888 | Medium | 6.3 | 2023-07-14 | Microsoft Edge for Android (Chromium-based) Tampering Vulnerability |
CVE-2023-3434 | Medium | 4.4 | 2023-07-14 | Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. This allows an attacker to send a custo… |
CVE-2023-3433 | Medium | 5.5 | 2023-07-14 | The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When… |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2023-29457 | Medium | 6.3 | 2023-07-13 | Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action for… |
CVE-2023-29456 | Medium | 5.7 | 2023-07-13 | URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL component… |
CVE-2023-29455 | Medium | 5.4 | 2023-07-13 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scri… |
CVE-2023-29454 | Medium | 5.4 | 2023-07-13 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves… |
CVE-2023-29452 | Medium | 5.5 | 2023-07-13 | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile… |
CVE-2023-29451 | Medium | 4.7 | 2023-07-13 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. |
CVE-2023-37415 | High | 8.8 | 2023-07-13 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the… |
CVE-2023-21251 | High | 7.3 | 2023-07-13 | In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to loca… |
CVE-2023-37948 | Low | 3.7 | 2023-07-12 | Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle at… |
CVE-2023-22888 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id paramete… |
CVE-2023-36872 | Medium | 5.5 | 2023-07-11 | VP9 Video Extensions Information Disclosure Vulnerability |
CVE-2023-35367 | Critical | 9.8 | 2023-07-11 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2023-35366 | Critical | 9.8 | 2023-07-11 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2023-35365 | Critical | 9.8 | 2023-07-11 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
CVE-2023-35336 | Medium | 6.5 | 2023-07-11 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-35306 | Medium | 5.5 | 2023-07-11 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-35303 | High | 8.8 | 2023-07-11 | USB Audio Class System Driver Remote Code Execution Vulnerability |
CVE-2023-32057 | Critical | 9.8 | 2023-07-11 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-32037 | Medium | 6.5 | 2023-07-11 | Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability |
CVE-2022-31810 | High | 7.5 | 2023-07-11 | A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets rec… |
CVE-2022-29562 | Low | 3.7 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2023-22835 | High | 7.7 | 2023-07-10 | A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caus… |
CVE-2023-30449 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM… |
CVE-2023-30448 | Medium | 5.9 | 2023-07-10 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30447 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30446 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30445 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30442 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash w… |
CVE-2023-28955 | Medium | 6.5 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service… |
CVE-2023-1183 | Medium | 5.0 | 2023-07-10 | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the f… |
CVE-2023-0359 | Medium | 5.9 | 2023-07-10 | A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
CVE-2023-36462 | Medium | 5.4 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacke… |
CVE-2023-3456 | Medium | 5.3 | 2023-07-06 | Vulnerability of kernel raw address leakage in the hang detector module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-37241 | High | 7.5 | 2023-07-06 | Input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-30664 | High | 8.5 | 2023-07-06 | Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30663 | Medium | 5.3 | 2023-07-06 | Improper input validation vulnerability in OemPersonalizationSetLock in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an Out-Of-Bo… |
CVE-2023-30659 | Medium | 6.2 | 2023-07-06 | Improper input validation vulnerability in Transaction prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30658 | High | 8.5 | 2023-07-06 | Improper input validation vulnerability in DataProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30657 | Medium | 6.2 | 2023-07-06 | Improper input validation vulnerability in EnhancedAttestationResult prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30656 | High | 8.5 | 2023-07-06 | Improper input validation vulnerability in LSOItemData prior to SMR Jul-2023 Release 1 allows attackers to launch certain activities. |
CVE-2023-30655 | High | 8.5 | 2023-07-06 | Improper input validation vulnerability in SCEPProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-36821 | High | 8.8 | 2023-07-05 | Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lea… |
CVE-2023-35936 | Medium | 6.1 | 2023-07-05 | Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prio… |
CVE-2023-34457 | Medium | 5.9 | 2023-07-05 | MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can r… |
CVE-2023-34150 | Medium | 6.5 | 2023-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. |
CVE-2023-21631 | High | 7.5 | 2023-07-04 | Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network. |
CVE-2023-25522 | High | 7.5 | 2023-07-04 | NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in a… |
CVE-2023-2728 | Medium | 6.5 | 2023-07-03 | Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers… |
CVE-2023-2727 | Medium | 6.5 | 2023-07-03 | Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only aff… |
CVE-2023-35797 | Critical | 9.8 | 2023-07-03 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: bef… |
CVE-2023-28324 | Critical | 9.8 | 2023-07-01 | A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. |
CVE-2023-22886 | High | 8.8 | 2023-06-29 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] paramet… |
CVE-2023-21192 | High | 7.8 | 2023-06-28 | In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper inp… |
CVE-2023-20192 | Critical | 9.6 | 2023-06-28 | Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administ… |
CVE-2023-20105 | Critical | 9.6 | 2023-06-28 | A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenti… |
CVE-2023-3034 | Medium | 4.7 | 2023-06-28 | Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44 |
CVE-2023-26273 | Medium | 4.3 | 2023-06-27 | IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134. |
CVE-2023-35798 | Medium | 4.3 | 2023-06-27 | Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulner… |
CVE-2023-34422 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due… |
CVE-2023-34421 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficien… |
CVE-2023-35163 | Medium | 6.0 | 2023-06-23 | Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists t… |
CVE-2023-25520 | Medium | 4.4 | 2023-06-23 | NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can configure invalid settings, resulting in deni… |
CVE-2023-32480 | Medium | 6.8 | 2023-06-23 | Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability to perform arbi… |