CWE-20 · Improper Input Validation (page 34)
Page 34 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24304 | High | 7.8 | 2023-03-28 | Improper input validation in the PDF.dll plugin of IrfanView v4.60 allows attackers to execute arbitrary code via opening a crafted PDF file. |
CVE-2023-25901 | High | 7.8 | 2023-03-28 | Adobe Dimension versions 3.4.7 (and earlier) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the con… |
CVE-2023-25881 | High | 7.8 | 2023-03-28 | Adobe Dimension versions 3.4.7 (and earlier) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the con… |
CVE-2023-25879 | High | 7.8 | 2023-03-28 | Adobe Dimension versions 3.4.7 (and earlier) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the con… |
CVE-2023-0775 | Medium | 6.5 | 2023-03-28 | An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests… |
CVE-2022-48356 | High | 7.5 | 2023-03-27 | The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recogn… |
CVE-2023-25867 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution… |
CVE-2023-25865 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution… |
CVE-2023-25661 | Medium | 6.5 | 2023-03-27 | TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and ca… |
CVE-2022-47925 | High | 7.5 | 2023-03-27 | The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validat… |
CVE-2022-47924 | Medium | 6.5 | 2023-03-27 | An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wi… |
CVE-2023-20976 | High | 7.3 | 2023-03-24 | In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default autofill application due to improper inp… |
CVE-2023-20960 | High | 8.8 | 2023-03-24 | In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper input validation. This… |
CVE-2022-42500 | Medium | 6.7 | 2023-03-24 | In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalation of privilege wi… |
CVE-2022-20542 | High | 7.8 | 2023-03-24 | In parseParamsBlob of types.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with n… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-28330 | Medium | 6.5 | 2023-03-23 | Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and ad… |
CVE-2023-1289 | Medium | 5.5 | 2023-03-23 | A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attack… |
CVE-2023-20072 | High | 8.6 | 2023-03-23 | A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause… |
CVE-2022-43863 | Medium | 6.7 | 2023-03-22 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to privilege escalation, allowing a user with some admin capabilities to gain additional admin capabilities. IBM X-F… |
CVE-2023-25859 | High | 7.8 | 2023-03-22 | Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary cod… |
CVE-2023-27984 | High | 7.8 | 2023-03-21 | A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code executio… |
CVE-2023-27586 | Critical | 9.9 | 2023-03-20 | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files… |
CVE-2023-1250 | High | 7.4 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When cr… |
CVE-2023-28113 | Medium | 5.9 | 2023-03-16 | russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficien… |
CVE-2023-21453 | Medium | 6.0 | 2023-03-16 | Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local attackers access to protected data. |
CVE-2023-28100 | Critical | 10.0 | 2023-03-16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 conta… |
CVE-2023-24571 | High | 7.5 | 2023-03-16 | Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with administrator privileges could potentially exploit th… |
CVE-2023-28099 | Medium | 5.9 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP addre… |
CVE-2023-28098 | Medium | 5.9 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenS… |
CVE-2023-28095 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` whic… |
CVE-2023-27601 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is receive… |
CVE-2023-27600 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is receive… |
CVE-2023-27599 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message w… |
CVE-2023-27597 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by… |
CVE-2023-0100 | High | 8.8 | 2023-03-15 | In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the rep… |
CVE-2023-24866 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-24865 | Medium | 6.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-24856 | High | 7.5 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
CVE-2023-23419 | High | 7.8 | 2023-03-14 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability |
CVE-2023-23416 | High | 7.8 | 2023-03-14 | Windows Cryptographic Services Remote Code Execution Vulnerability |
CVE-2023-23409 | Medium | 5.5 | 2023-03-14 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability |
CVE-2023-23397 | Critical | 9.8 | 2023-03-14 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2023-24579 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. |
CVE-2023-24033 | High | 7.5 | 2023-03-13 | The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types spec… |
CVE-2023-24975 | Medium | 5.4 | 2023-03-10 | IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to… |
CVE-2020-5002 | Medium | 4.3 | 2023-03-10 | IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-For… |
CVE-2023-25947 | Medium | 6.2 | 2023-03-10 | The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this… |
CVE-2023-24465 | Medium | 5.5 | 2023-03-10 | Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability w… |
CVE-2023-22301 | Medium | 6.5 | 2023-03-10 | The kernel subsystem hmdfs within OpenHarmony-v3.1.5 and prior versions has an arbitrary memory accessing vulnerability which network attackers can launch a… |
CVE-2022-3767 | High | 7.7 | 2023-03-09 | Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless… |
CVE-2023-27484 | Medium | 6.2 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly p… |
CVE-2023-27483 | Medium | 5.9 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has… |
CVE-2023-20651 | Medium | 4.4 | 2023-03-07 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20650 | Medium | 6.7 | 2023-03-07 | In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20649 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20648 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20647 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20646 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20645 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20644 | Medium | 4.4 | 2023-03-07 | In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20643 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20642 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20641 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20640 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20639 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20638 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20637 | Medium | 6.7 | 2023-03-07 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20636 | Medium | 6.7 | 2023-03-07 | In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2023-20634 | Medium | 6.7 | 2023-03-07 | In widevine, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution p… |
CVE-2023-20626 | Medium | 6.7 | 2023-03-07 | In msdc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20621 | Medium | 6.7 | 2023-03-07 | In tinysys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-4904 | High | 8.6 | 2023-03-06 | A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary lengt… |
CVE-2021-36402 | Medium | 5.3 | 2023-03-06 | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. |
CVE-2022-3294 | Medium | 6.6 | 2023-03-01 | Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and… |
CVE-2023-26281 | Medium | 5.9 | 2023-03-01 | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force… |
CVE-2023-20009 | Medium | 6.5 | 2023-03-01 | A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authen… |
CVE-2022-20952 | Medium | 5.3 | 2023-03-01 | A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could a… |
CVE-2023-20932 | Low | 3.3 | 2023-02-28 | In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could… |
CVE-2022-40237 | Medium | 6.5 | 2023-02-27 | IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic. IBM X-Force ID: 2… |
CVE-2021-35370 | Critical | 9.8 | 2023-02-24 | An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function. |
CVE-2023-25696 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. |
CVE-2023-25693 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
CVE-2023-25692 | High | 7.5 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25691 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-0869 | Medium | 5.8 | 2023-02-23 | Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The… |
CVE-2023-0868 | Medium | 6.7 | 2023-02-23 | Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. U… |
CVE-2023-0867 | Medium | 6.7 | 2023-02-23 | Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an atta… |
CVE-2022-48321 | Medium | 6.8 | 2023-02-20 | Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted e… |
CVE-2022-47909 | Medium | 6.8 | 2023-02-20 | Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk… |
CVE-2022-46836 | Critical | 9.1 | 2023-02-20 | PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to in… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2023-22239 | High | 7.8 | 2023-02-17 | After Affects versions 23.1 (and earlier), 22.6.3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code… |
CVE-2023-22228 | High | 7.8 | 2023-02-17 | Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary c… |
CVE-2023-21621 | High | 7.8 | 2023-02-17 | FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execu… |
CVE-2023-21574 | High | 7.8 | 2023-02-17 | Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execu… |
CVE-2022-43929 | Medium | 4.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID… |
CVE-2023-24329 | High | 7.5 | 2023-02-17 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank charac… |
CVE-2022-33964 | High | 7.4 | 2023-02-16 | Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege… |
CVE-2022-33190 | High | 7.1 | 2023-02-16 | Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege vi… |