CWE-20 · Improper Input Validation (page 33)
Page 33 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31149 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-31148 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-25776 | Medium | 6.3 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2023-25772 | Medium | 5.0 | 2023-05-10 | Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potential… |
CVE-2023-25175 | Medium | 6.1 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2023-22379 | Medium | 6.7 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2022-38787 | Medium | 5.7 | 2023-05-10 | Improper input validation in firmware for some Intel(R) FPGA products before version 2.7.0 Hotfix may allow an authenticated user to potentially enable escalat… |
CVE-2022-37327 | Medium | 6.1 | 2023-05-10 | Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, In… |
CVE-2022-36339 | High | 7.5 | 2023-05-10 | Improper input validation in firmware for Intel(R) NUC 8 Compute Element, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element may allow a privileg… |
CVE-2022-34147 | High | 7.5 | 2023-05-10 | Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(… |
CVE-2022-33894 | High | 7.5 | 2023-05-10 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2022-32766 | High | 7.2 | 2023-05-10 | Improper input validation for some Intel(R) BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-32577 | Low | 3.4 | 2023-05-10 | Improper input validation in BIOS Firmware for some Intel(R) NUC Kits before version PY0081 may allow a privileged user to potentially enable information discl… |
CVE-2022-28699 | High | 7.5 | 2023-05-10 | Improper input validation for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-25976 | Medium | 5.5 | 2023-05-10 | Improper input validation in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable denial of service via l… |
CVE-2023-1732 | Medium | 5.3 | 2023-05-10 | When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare depl… |
CVE-2021-46773 | High | 8.8 | 2023-05-09 | Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution. … |
CVE-2021-46756 | Critical | 9.1 | 2023-05-09 | Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send… |
CVE-2021-46754 | Critical | 9.1 | 2023-05-09 | Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into e… |
CVE-2022-23818 | High | 7.5 | 2023-05-09 | Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity. … |
CVE-2021-46775 | Medium | 6.8 | 2023-05-09 | Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrit… |
CVE-2021-46769 | High | 8.8 | 2023-05-09 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution… |
CVE-2021-46762 | Low | 3.9 | 2023-05-09 | Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service. |
CVE-2023-29335 | High | 7.5 | 2023-05-09 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2023-24950 | Medium | 6.5 | 2023-05-09 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2023-28200 | Medium | 5.5 | 2023-05-08 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6… |
CVE-2023-27961 | Medium | 5.5 | 2023-05-08 | Multiple validation issues were addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and… |
CVE-2023-31039 | Critical | 9.8 | 2023-05-08 | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can infl… |
CVE-2023-31047 | Critical | 9.8 | 2023-05-07 | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. T… |
CVE-2023-30434 | Medium | 6.2 | 2023-05-05 | IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through… |
CVE-2022-43919 | Medium | 5.3 | 2023-05-05 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-For… |
CVE-2023-21504 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid m… |
CVE-2023-21503 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause inva… |
CVE-2023-21502 | Medium | 5.7 | 2023-05-04 | Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debug… |
CVE-2023-21501 | High | 8.2 | 2023-05-04 | Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-21498 | Medium | 6.0 | 2023-05-04 | Improper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to overwrite the trustl… |
CVE-2023-21494 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause… |
CVE-2023-26125 | Medium | 5.6 | 2023-05-04 | Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted re… |
CVE-2023-0683 | High | 8.3 | 2023-05-01 | A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
CVE-2022-46365 | Critical | 9.1 | 2023-05-01 | Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter… |
CVE-2023-0896 | High | 8.8 | 2023-05-01 | A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local netwo… |
CVE-2023-26022 | Medium | 5.9 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs usi… |
CVE-2023-26021 | High | 7.5 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a s… |
CVE-2023-27555 | Medium | 5.1 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfe… |
CVE-2023-25930 | Medium | 5.9 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a… |
CVE-2023-29255 | High | 7.5 | 2023-04-27 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a var… |
CVE-2023-27559 | Medium | 5.3 | 2023-04-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using… |
CVE-2023-30269 | High | 8.1 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php. |
CVE-2022-25273 | High | 7.5 | 2023-04-26 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2023-29530 | High | 7.5 | 2023-04-24 | Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users wh… |
CVE-2023-29780 | High | 7.5 | 2023-04-24 | Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable… |
CVE-2023-22916 | High | 8.1 | 2023-04-24 | The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware… |
CVE-2023-22581 | Critical | 9.8 | 2023-04-24 | White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the d… |
CVE-2022-29606 | Critical | 9.8 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling… |
CVE-2023-21092 | High | 7.8 | 2023-04-19 | In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to imp… |
CVE-2023-27043 | Medium | 5.3 | 2023-04-19 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is ident… |
CVE-2023-29410 | High | 7.2 | 2023-04-18 | A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the serve… |
CVE-2023-28856 | Medium | 5.5 | 2023-04-18 | Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that… |
CVE-2023-28981 | Medium | 6.5 | 2023-04-17 | An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to caus… |
CVE-2023-30542 | Medium | 6.8 | 2023-04-16 | OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows… |
CVE-2023-30535 | High | 7.3 | 2023-04-14 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC drive… |
CVE-2023-29194 | Medium | 4.1 | 2023-04-14 | Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` charac… |
CVE-2022-33211 | Critical | 9.8 | 2023-04-13 | memory corruption in modem due to improper check while calculating size of serialized CoAP message |
CVE-2023-26388 | High | 7.8 | 2023-04-12 | Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution i… |
CVE-2023-26407 | High | 7.8 | 2023-04-12 | Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnerability that could r… |
CVE-2023-26405 | High | 7.8 | 2023-04-12 | Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnerability that could r… |
CVE-2023-28304 | High | 7.8 | 2023-04-11 | Microsoft ODBC and OLE DB Remote Code Execution Vulnerability |
CVE-2023-28302 | High | 7.5 | 2023-04-11 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-28301 | Low | 3.7 | 2023-04-11 | Microsoft Edge (Chromium-based) Tampering Vulnerability |
CVE-2023-28291 | High | 8.4 | 2023-04-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2023-28274 | High | 7.8 | 2023-04-11 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2023-24893 | High | 7.8 | 2023-04-11 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-23375 | High | 7.8 | 2023-04-11 | Microsoft ODBC and OLE DB Remote Code Execution Vulnerability |
CVE-2023-21554 | Critical | 9.8 | 2023-04-11 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2022-42477 | High | 7.1 | 2023-04-11 | An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authentica… |
CVE-2023-26293 | High | 7.3 | 2023-04-11 | A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal)… |
CVE-2023-26070 | Critical | 9.8 | 2023-04-10 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4). |
CVE-2023-26069 | Critical | 9.8 | 2023-04-10 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4). |
CVE-2023-26068 | Critical | 9.8 | 2023-04-10 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). |
CVE-2023-26067 | High | 8.1 | 2023-04-10 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). |
CVE-2023-30450 | Medium | 4.3 | 2023-04-08 | rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_server_tls field, leading to (for example) situations in which there is a data type mismatch that can… |
CVE-2023-28710 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4… |
CVE-2023-28707 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2… |
CVE-2023-20103 | Medium | 4.9 | 2023-04-05 | A vulnerability in Cisco Secure Network Analytics could allow an authenticated, remote attacker to execute arbitrary code as a root user on an affected device… |
CVE-2023-20134 | Medium | 5.4 | 2023-04-05 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (X… |
CVE-2023-20132 | Medium | 5.4 | 2023-04-05 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (X… |
CVE-2023-27496 | Medium | 6.5 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth… |
CVE-2023-27493 | High | 8.1 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does… |
CVE-2023-27491 | Medium | 5.4 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to… |
CVE-2023-27488 | Medium | 5.4 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation… |
CVE-2023-27487 | High | 8.2 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client… |
CVE-2023-1789 | Critical | 9.8 | 2023-04-01 | Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0. |
CVE-2022-47192 | High | 8.8 | 2023-03-31 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device… |
CVE-2022-47191 | Medium | 4.3 | 2023-03-31 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to esca… |
CVE-2022-47190 | Critical | 10.0 | 2023-03-31 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary c… |
CVE-2022-47189 | High | 7.5 | 2023-03-31 | Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functio… |
CVE-2022-47188 | High | 7.5 | 2023-03-31 | There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a ba… |
CVE-2023-28733 | High | 7.2 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when acce… |
CVE-2023-28732 | Medium | 6.5 | 2023-03-30 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system… |
CVE-2023-28731 | Critical | 9.8 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to un… |