CWE-20 · Improper Input Validation (page 35)
Page 35 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29494 | Medium | 6.5 | 2023-02-16 | Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authenticated user to pote… |
CVE-2022-26837 | High | 7.5 | 2023-02-16 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2023-24807 | High | 7.5 | 2023-02-16 | Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Deni… |
CVE-2022-27897 | Medium | 5.3 | 2023-02-16 | Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attack… |
CVE-2022-27892 | Medium | 5.3 | 2023-02-16 | Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispat… |
CVE-2023-23934 | Low | 2.6 | 2023-02-14 | Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable br… |
CVE-2023-21818 | High | 7.5 | 2023-02-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-21816 | High | 7.5 | 2023-02-14 | Windows Active Directory Domain Services API Denial of Service Vulnerability |
CVE-2023-21685 | High | 8.8 | 2023-02-14 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-22940 | Medium | 6.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘su… |
CVE-2023-22939 | High | 8.1 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky… |
CVE-2023-22937 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extens… |
CVE-2023-22935 | High | 8.1 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safegua… |
CVE-2023-22934 | High | 7.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for ris… |
CVE-2022-31808 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affecte… |
CVE-2022-45725 | High | 8.8 | 2023-02-13 | Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP… |
CVE-2022-45088 | Critical | 9.8 | 2023-02-12 | Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower… |
CVE-2022-40502 | High | 7.5 | 2023-02-12 | Transient DOS due to improper input validation in WLAN Host. |
CVE-2022-34146 | High | 7.5 | 2023-02-12 | Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation. |
CVE-2022-33216 | Medium | 6.0 | 2023-02-12 | Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file. |
CVE-2022-25729 | Critical | 9.8 | 2023-02-12 | Memory corruption in modem due to improper length check while copying into memory |
CVE-2023-24816 | Medium | 4.5 | 2023-02-10 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2023-24569 | High | 7.8 | 2023-02-10 | Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local authenticated malicious user could poten… |
CVE-2018-7935 | Medium | 5.3 | 2023-02-10 | There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerability to make the network where the E5573C… |
CVE-2023-21451 | Medium | 6.7 | 2023-02-09 | A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions. |
CVE-2023-21446 | Medium | 6.2 | 2023-02-09 | Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local att… |
CVE-2023-21439 | High | 8.5 | 2023-02-09 | Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activities. |
CVE-2023-21434 | Medium | 6.2 | 2023-02-09 | Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page. |
CVE-2023-21431 | Low | 3.3 | 2023-02-09 | Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision. |
CVE-2023-21428 | Medium | 4.0 | 2023-02-09 | Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused c… |
CVE-2022-38778 | Medium | 6.5 | 2023-02-08 | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes th… |
CVE-2023-0751 | Medium | 6.5 | 2023-02-08 | When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent… |
CVE-2022-34350 | Medium | 5.3 | 2023-02-08 | IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack… |
CVE-2023-0615 | Medium | 5.5 | 2023-02-06 | A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs wh… |
CVE-2022-44617 | High | 7.5 | 2023-02-06 | A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an… |
CVE-2023-20613 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20612 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20606 | Medium | 4.4 | 2023-02-06 | In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2022-32482 | Medium | 5.6 | 2023-02-01 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnera… |
CVE-2022-34443 | High | 7.8 | 2023-02-01 | Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Local Low Privilege attacker could potentia… |
CVE-2022-44644 | Medium | 6.5 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecti… |
CVE-2022-39060 | Critical | 9.8 | 2023-01-31 | ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability… |
CVE-2022-34885 | High | 7.2 | 2023-01-30 | An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code. |
CVE-2022-45770 | High | 7.8 | 2023-01-26 | Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escalation. |
CVE-2023-24493 | Medium | 5.7 | 2023-01-26 | A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacke… |
CVE-2023-0284 | Medium | 6.8 | 2023-01-26 | Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1… |
CVE-2023-0229 | Medium | 6.3 | 2023-01-26 | A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to s… |
CVE-2022-47100 | High | 7.5 | 2023-01-26 | A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame. |
CVE-2022-3736 | High | 7.5 | 2023-01-26 | BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver r… |
CVE-2023-23560 | Critical | 9.8 | 2023-01-23 | In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. |
CVE-2021-43448 | Medium | 5.3 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of use… |
CVE-2023-0434 | High | 7.5 | 2023-01-22 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. |
CVE-2022-41733 | Medium | 5.3 | 2023-01-20 | IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Forc… |
CVE-2023-20045 | Medium | 4.9 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker… |
CVE-2023-20026 | Medium | 6.5 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated… |
CVE-2023-20020 | High | 8.6 | 2023-01-20 | A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform c… |
CVE-2023-21607 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Improper Input Validatio… |
CVE-2022-47966 | Critical | 9.8 | 2023-01-18 | Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka… |
CVE-2022-34436 | Low | 2.7 | 2023-01-18 | Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34435 | Low | 2.7 | 2023-01-18 | Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34460 | High | 7.5 | 2023-01-18 | Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability b… |
CVE-2022-34393 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32490 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-47917 | Medium | 6.8 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to sev… |
CVE-2022-43455 | Medium | 5.5 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the… |
CVE-2023-22734 | Medium | 4.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it wa… |
CVE-2023-22730 | Medium | 5.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple tim… |
CVE-2022-41861 | Medium | 6.5 | 2023-01-17 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. |
CVE-2023-0299 | Critical | 9.8 | 2023-01-14 | Improper Input Validation in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-22496 | High | 8.1 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection… |
CVE-2023-22470 | Low | 3.5 | 2023-01-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error ca… |
CVE-2023-21596 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code exe… |
CVE-2023-21588 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code ex… |
CVE-2023-22491 | High | 8.1 | 2023-01-13 | Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions… |
CVE-2022-46372 | High | 7.2 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution. |
CVE-2022-4428 | High | 8.9 | 2023-01-11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitra… |
CVE-2023-22952 | High | 8.8 | 2023-01-11 | In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. |
CVE-2023-20532 | Medium | 5.3 | 2023-01-11 | Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. |
CVE-2023-20530 | High | 7.5 | 2023-01-11 | Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service. |
CVE-2023-20528 | Low | 2.4 | 2023-01-11 | Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of conf… |
CVE-2023-20527 | Medium | 6.5 | 2023-01-11 | Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-servic… |
CVE-2023-20525 | Medium | 6.5 | 2023-01-11 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially… |
CVE-2023-20522 | High | 7.5 | 2023-01-11 | Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. |
CVE-2022-23814 | Medium | 5.3 | 2023-01-11 | Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute envir… |
CVE-2021-46767 | Medium | 6.1 | 2023-01-11 | Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integ… |
CVE-2021-26404 | Medium | 5.5 | 2023-01-11 | Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. |
CVE-2021-26316 | High | 7.8 | 2023-01-11 | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (… |
CVE-2023-22963 | Medium | 5.3 | 2023-01-11 | The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression. |
CVE-2023-21767 | High | 7.8 | 2023-01-10 | Windows Overlay Filter Elevation of Privilege Vulnerability |
CVE-2023-21749 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21559 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21558 | High | 7.8 | 2023-01-10 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2023-21550 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21540 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-0139 | Medium | 6.5 | 2023-01-10 | Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restric… |
CVE-2023-22898 | Medium | 6.5 | 2023-01-10 | workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP b… |
CVE-2022-33300 | High | 8.4 | 2023-01-09 | Memory corruption in Automotive Android OS due to improper input validation. |
CVE-2022-23549 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22465 | High | 7.5 | 2023-01-04 | Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and… |
CVE-2023-22460 | High | 7.5 | 2023-01-04 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |