CWE-20 · Improper Input Validation (page 32)
Page 32 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7163 | Critical | 10.0 | 2023-12-28 | A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could… |
CVE-2023-6879 | Critical | 9.0 | 2023-12-27 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
CVE-2023-31455 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. |
CVE-2023-31289 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. |
CVE-2023-39251 | Medium | 6.7 | 2023-12-22 | Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in ord… |
CVE-2023-45165 | Medium | 6.2 | 2023-12-22 | IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 26… |
CVE-2023-6784 | Medium | 4.7 | 2023-12-20 | A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. |
CVE-2023-0011 | High | 7.6 | 2023-12-20 | A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerabili… |
CVE-2023-47705 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID… |
CVE-2023-47161 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leadin… |
CVE-2023-42012 | Medium | 6.2 | 2023-12-20 | An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a deni… |
CVE-2023-45172 | Medium | 6.2 | 2023-12-19 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. IBM X-Force ID… |
CVE-2023-22439 | Low | 3.1 | 2023-12-18 | Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perfor… |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |
CVE-2023-32728 | Medium | 4.6 | 2023-12-18 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote… |
CVE-2023-32727 | Medium | 6.8 | 2023-12-18 | An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code o… |
CVE-2023-46116 | Critical | 9.3 | 2023-12-15 | Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it corr… |
CVE-2023-48608 | Low | 3.5 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Input Validation vulnerability. A low-privileged attacker could leverage this… |
CVE-2023-33217 | High | 7.5 | 2023-12-15 | By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. th… |
CVE-2023-6835 | Medium | 4.3 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated. |
CVE-2023-48631 | Medium | 5.3 | 2023-12-14 | @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attemptin… |
CVE-2023-25651 | Medium | 4.3 | 2023-12-14 | There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated… |
CVE-2023-25650 | Medium | 6.5 | 2023-12-14 | There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user… |
CVE-2023-50709 | Medium | 6.5 | 2023-12-13 | Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a speci… |
CVE-2023-50262 | Medium | 5.3 | 2023-12-13 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One… |
CVE-2023-48634 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbi… |
CVE-2023-6381 | Low | 3.3 | 2023-12-13 | Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by send… |
CVE-2023-35619 | Medium | 5.3 | 2023-12-12 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2023-46285 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-49796 | Medium | 5.3 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users sh… |
CVE-2023-48425 | Critical | 9.8 | 2023-12-11 | U-Boot vulnerability resulting in persistent Code Execution |
CVE-2023-48311 | High | 8.0 | 2023-12-08 | dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11… |
CVE-2023-6245 | High | 7.5 | 2023-12-08 | The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { *… |
CVE-2023-5058 | High | 7.8 | 2023-12-07 | Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of… |
CVE-2023-49958 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTra… |
CVE-2023-39539 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful… |
CVE-2023-39538 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful… |
CVE-2023-49248 | Medium | 5.5 | 2023-12-06 | Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access. |
CVE-2023-41268 | Medium | 5.3 | 2023-12-06 | Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects Escargot: from 3.0.0 t… |
CVE-2023-40053 | Medium | 5.0 | 2023-12-06 | A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which… |
CVE-2023-5188 | High | 7.5 | 2023-12-05 | The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote un… |
CVE-2023-33042 | High | 7.5 | 2023-12-05 | Transient DOS in Modem after RRC Setup message is received. |
CVE-2023-48693 | High | 8.7 | 2023-12-05 | Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary re… |
CVE-2023-49291 | Critical | 9.3 | 2023-12-05 | tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly… |
CVE-2023-40097 | High | 7.8 | 2023-12-04 | In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validation. This could lead to local escalation o… |
CVE-2023-47106 | Medium | 4.8 | 2023-12-04 | Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and fo… |
CVE-2023-40687 | Medium | 5.3 | 2023-12-04 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS com… |
CVE-2023-38727 | Medium | 5.3 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statemen… |
CVE-2023-29258 | Medium | 5.3 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated que… |
CVE-2023-47701 | Medium | 6.5 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM… |
CVE-2023-46167 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-45178 | Medium | 6.5 | 2023-12-03 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM… |
CVE-2023-40699 | High | 7.5 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-34390 | Medium | 4.5 | 2023-11-30 | An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service… |
CVE-2023-2267 | Medium | 4.3 | 2023-11-30 | An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an aut… |
CVE-2023-2264 | Medium | 4.0 | 2023-11-30 | An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to… |
CVE-2023-49095 | High | 8.6 | 2023-11-30 | nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certa… |
CVE-2023-49081 | High | 7.2 | 2023-11-30 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request… |
CVE-2023-5275 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-5274 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-49082 | Medium | 5.3 | 2023-11-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP reques… |
CVE-2023-35136 | Medium | 5.5 | 2023-11-28 | An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versio… |
CVE-2023-48226 | Medium | 6.5 | 2023-11-21 | OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like valid… |
CVE-2023-48310 | Critical | 9.1 | 2023-11-20 | TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap options are accepted… |
CVE-2023-48223 | Medium | 5.9 | 2023-11-20 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for… |
CVE-2023-44355 | Medium | 4.3 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Secu… |
CVE-2023-26364 | Medium | 5.3 | 2023-11-17 | @adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while atte… |
CVE-2023-22272 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unau… |
CVE-2023-40314 | Medium | 5.8 | 2023-11-16 | Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. Th… |
CVE-2023-32469 | High | 7.5 | 2023-11-16 | Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially… |
CVE-2023-47003 | Critical | 9.8 | 2023-11-16 | An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. |
CVE-2023-39537 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-39536 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-39535 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-5528 | High | 7.2 | 2023-11-14 | A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privil… |
CVE-2023-36049 | High | 7.6 | 2023-11-14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-39411 | Medium | 5.0 | 2023-11-14 | Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-38131 | Medium | 6.5 | 2023-11-14 | Improper input validationation for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access. |
CVE-2023-36860 | High | 7.1 | 2023-11-14 | Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-34431 | High | 8.2 | 2023-11-14 | Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access |
CVE-2023-32641 | High | 7.3 | 2023-11-14 | Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of service via adjacent… |
CVE-2023-31320 | High | 7.5 | 2023-11-14 | Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in denial of service. … |
CVE-2023-31203 | Medium | 4.3 | 2023-11-14 | Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow an unauthenticated… |
CVE-2023-27519 | Medium | 6.9 | 2023-11-14 | Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via l… |
CVE-2023-22337 | High | 7.5 | 2023-11-14 | Improper input validation for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2023-22329 | Low | 2.6 | 2023-11-14 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via adjacen… |
CVE-2022-45469 | Low | 2.2 | 2023-11-14 | Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2022-33945 | High | 8.2 | 2023-11-14 | Improper input validation in some Intel(R) Server board and Intel(R) Server System BIOS firmware may allow a privileged user to potentially enable escalation o… |
CVE-2022-24379 | High | 7.5 | 2023-11-14 | Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user to potentially enabl… |
CVE-2022-23820 | High | 7.5 | 2023-11-14 | Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. |
CVE-2023-36719 | High | 7.8 | 2023-11-14 | Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability |
CVE-2023-36407 | High | 7.8 | 2023-11-14 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2023-36406 | Medium | 5.5 | 2023-11-14 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2023-36021 | High | 8.0 | 2023-11-14 | Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability |
CVE-2023-6073 | Medium | 5.7 | 2023-11-10 | Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) an… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-5079 | High | 7.5 | 2023-11-08 | Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information di… |
CVE-2023-43570 | Medium | 6.7 | 2023-11-08 | A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute… |
CVE-2023-47107 | High | 8.8 | 2023-11-08 | PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname… |
CVE-2023-6012 | High | 8.3 | 2023-11-08 | An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacke… |