CWE-20 · Improper Input Validation (page 32)
Page 32 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28060 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28058 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28050 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28044 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28036 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28034 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28031 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28027 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28026 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-25938 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28061 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28059 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28056 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28054 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28052 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28042 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28041 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28040 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28039 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28035 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28033 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28032 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28030 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28029 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-28028 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-25937 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-25936 | Medium | 5.1 | 2023-06-23 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this… |
CVE-2023-32463 | Low | 3.4 | 2023-06-23 | Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could po… |
CVE-2023-0026 | High | 7.5 | 2023-06-21 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, ne… |
CVE-2023-29293 | Low | 2.7 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that… |
CVE-2023-21143 | Medium | 5.5 | 2023-06-15 | In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could lead to local denial… |
CVE-2023-21138 | High | 7.8 | 2023-06-15 | In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalat… |
CVE-2023-21136 | Medium | 5.5 | 2023-06-15 | In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input validation. This could lead to local denial o… |
CVE-2023-21135 | High | 7.8 | 2023-06-15 | In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead… |
CVE-2023-21121 | High | 7.8 | 2023-06-15 | In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to improper input validation… |
CVE-2023-34448 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav lev… |
CVE-2023-30631 | High | 7.5 | 2023-06-14 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled di… |
CVE-2023-24937 | Medium | 6.5 | 2023-06-14 | Windows CryptoAPI Denial of Service Vulnerability |
CVE-2023-32032 | Medium | 6.5 | 2023-06-14 | .NET and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-32015 | Critical | 9.8 | 2023-06-14 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2023-29371 | High | 7.8 | 2023-06-14 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-29359 | High | 7.8 | 2023-06-14 | GDI Elevation of Privilege Vulnerability |
CVE-2023-29353 | Medium | 5.5 | 2023-06-14 | Sysinternals Process Monitor for Windows Denial of Service Vulnerability |
CVE-2023-2455 | Medium | 5.4 | 2023-06-09 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific p… |
CVE-2023-2454 | High | 7.2 | 2023-06-09 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated dat… |
CVE-2023-1888 | High | 8.8 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of valida… |
CVE-2023-34239 | High | 7.3 | 2023-06-08 | Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restr… |
CVE-2023-2961 | Low | 3.3 | 2023-06-06 | A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability. |
CVE-2023-34111 | High | 8.1 | 2023-06-06 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code exec… |
CVE-2023-21657 | High | 7.8 | 2023-06-06 | Memoru corruption in Audio when ADSP sends input during record use case. |
CVE-2023-21656 | High | 7.8 | 2023-06-06 | Memory corruption in WLAN HOST while receiving an WMI event from firmware. |
CVE-2023-34102 | High | 8.3 | 2023-06-05 | Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with use… |
CVE-2023-32690 | Medium | 5.7 | 2023-06-01 | libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a… |
CVE-2022-4332 | Medium | 6.8 | 2023-06-01 | In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical access and hardware mani… |
CVE-2023-33964 | High | 8.6 | 2023-05-31 | mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to v… |
CVE-2023-34152 | Critical | 9.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. |
CVE-2023-0779 | Medium | 6.7 | 2023-05-30 | At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation i… |
CVE-2023-23754 | Medium | 6.1 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen. |
CVE-2023-33182 | Unrated | | 2023-05-30 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript… |
CVE-2023-2808 | Medium | 4.3 | 2023-05-29 | Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link… |
CVE-2023-2942 | High | 8.1 | 2023-05-27 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-32695 | High | 7.3 | 2023-05-27 | socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet… |
CVE-2023-32688 | Medium | 4.9 | 2023-05-27 | parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid pu… |
CVE-2023-32321 | Critical | 9.8 | 2023-05-26 | CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to… |
CVE-2023-21516 | High | 7.5 | 2023-05-26 | XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. |
CVE-2023-21515 | High | 7.5 | 2023-05-26 | InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript AP… |
CVE-2023-21514 | High | 7.5 | 2023-05-26 | Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from G… |
CVE-2023-32323 | Medium | 5.0 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to… |
CVE-2023-2868 | Critical | 9.4 | 2023-05-24 | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0… |
CVE-2021-25748 | High | 7.6 | 2023-05-24 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization… |
CVE-2023-30440 | Medium | 6.7 | 2023-05-23 | IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW… |
CVE-2023-28649 | High | 8.6 | 2023-05-22 | The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attack… |
CVE-2023-20182 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20172 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-20171 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-21111 | Medium | 5.5 | 2023-05-15 | In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input validation. This c… |
CVE-2023-20722 | Medium | 6.7 | 2023-05-15 | In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20721 | Medium | 6.7 | 2023-05-15 | In isp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20720 | Medium | 6.7 | 2023-05-15 | In pqframework, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-20719 | Medium | 4.4 | 2023-05-15 | In pqframework, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-20718 | Medium | 6.7 | 2023-05-15 | In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20710 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20709 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20708 | Medium | 6.7 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20707 | Medium | 6.7 | 2023-05-15 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20705 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-20704 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2022-47392 | Medium | 6.5 | 2023-05-15 | An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products… |
CVE-2022-47937 | Critical | 9.8 | 2023-05-15 | Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The or… |
CVE-2022-47391 | High | 7.5 | 2023-05-15 | In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addre… |
CVE-2022-47378 | Medium | 6.5 | 2023-05-15 | Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requ… |
CVE-2022-22508 | Medium | 4.3 | 2023-05-15 | Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type. |
CVE-2023-32305 | High | 8.8 | 2023-05-12 | aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL… |
CVE-2023-25927 | Medium | 6.5 | 2023-05-12 | IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacker to crash the webseald process using specially crafted HTT… |
CVE-2023-29246 | High | 7.2 | 2023-05-12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apach… |
CVE-2023-29195 | Medium | 4.1 | 2023-05-11 | Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or… |
CVE-2023-29026 | Medium | 4.7 | 2023-05-11 | A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin… |
CVE-2023-32075 | Medium | 4.3 | 2023-05-11 | The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to… |
CVE-2023-31162 | Medium | 4.8 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a re… |
CVE-2023-31161 | Medium | 5.9 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an a… |