CWE-20 · Improper Input Validation (page 36)
Page 36 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45875 | Critical | 9.8 | 2023-01-04 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache Do… |
CVE-2022-32653 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32652 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-22452 | Medium | 6.5 | 2023-01-02 | kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior… |
CVE-2022-42269 | High | 7.9 | 2022-12-30 | NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to ca… |
CVE-2022-34681 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-re… |
CVE-2022-39012 | High | 7.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. |
CVE-2020-36564 | High | 7.5 | 2022-12-27 | Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be… |
CVE-2022-43849 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of se… |
CVE-2022-43848 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial o… |
CVE-2022-40233 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of… |
CVE-2022-40898 | High | 7.5 | 2022-12-23 | An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled… |
CVE-2022-22184 | High | 7.5 | 2022-12-22 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated net… |
CVE-2022-34476 | Critical | 9.8 | 2022-12-22 | ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Fire… |
CVE-2022-22749 | Medium | 4.3 | 2022-12-22 | When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for… |
CVE-2022-44756 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged ac… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2022-46328 | High | 7.5 | 2022-12-20 | Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-43875 | Medium | 6.2 | 2022-12-20 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting… |
CVE-2022-25940 | High | 7.5 | 2022-12-20 | All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the d… |
CVE-2022-46401 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete. |
CVE-2022-3752 | High | 8.6 | 2022-12-19 | An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service conditio… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-26582 | High | 7.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attack… |
CVE-2022-3157 | High | 8.6 | 2022-12-16 | A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-o… |
CVE-2022-42534 | High | 7.8 | 2022-12-16 | In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible privilege escalation due to improper input validation. This could lead to local escalatio… |
CVE-2022-20592 | Medium | 5.5 | 2022-12-16 | In ppmp_validate_secbuf of drm_fw.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosu… |
CVE-2022-20590 | Medium | 5.5 | 2022-12-16 | In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input validation. This could lead to local inform… |
CVE-2022-20589 | Medium | 4.4 | 2022-12-16 | In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could lead to local information disclosure with… |
CVE-2022-20587 | High | 7.8 | 2022-12-16 | In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional… |
CVE-2022-20586 | High | 7.8 | 2022-12-16 | In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of… |
CVE-2022-20585 | High | 7.8 | 2022-12-16 | In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of… |
CVE-2022-20584 | High | 7.8 | 2022-12-16 | In page_number of shared_mem.c, there is a possible code execution in secure world due to improper input validation. This could lead to local escalation of pri… |
CVE-2022-20545 | High | 7.5 | 2022-12-16 | In bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input validation. This could lead to remote denia… |
CVE-2022-20512 | High | 7.8 | 2022-12-16 | In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to… |
CVE-2022-20507 | High | 7.8 | 2022-12-16 | In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds check. This could le… |
CVE-2021-28655 | Medium | 6.5 | 2022-12-16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue… |
CVE-2022-46701 | High | 7.8 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious… |
CVE-2022-42837 | Critical | 9.8 | 2022-12-15 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur… |
CVE-2022-46768 | Medium | 5.9 | 2022-12-15 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation… |
CVE-2022-4504 | High | 7.5 | 2022-12-15 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-43723 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly va… |
CVE-2022-20470 | High | 7.8 | 2022-12-13 | In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input validation. This cou… |
CVE-2021-44695 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-44694 | Medium | 5.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-40365 | High | 7.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2022-46363 | High | 7.5 | 2022-12-13 | A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability… |
CVE-2022-45871 | Medium | 4.3 | 2022-12-13 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP re… |
CVE-2022-45113 | Medium | 6.5 | 2022-12-07 | Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a r… |
CVE-2022-33876 | Medium | 5.4 | 2022-12-06 | Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allow… |
CVE-2022-38123 | High | 8.7 | 2022-12-06 | Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager i… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-43484 | High | 7.8 | 2022-12-05 | TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader ma… |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2022-1471 | High | 8.3 | 2022-12-01 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker ca… |
CVE-2022-40265 | High | 8.6 | 2022-11-30 | Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric… |
CVE-2022-4186 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-4033 | Medium | 5.3 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0… |
CVE-2022-4032 | High | 7.2 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due… |
CVE-2022-36960 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to e… |
CVE-2022-41921 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial o… |
CVE-2022-38900 | High | 7.5 | 2022-11-28 | decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-39338 | Low | 3.5 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross si… |
CVE-2022-40266 | Medium | 5.3 | 2022-11-24 | Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 S… |
CVE-2022-45872 | Critical | 9.8 | 2022-11-23 | iTerm2 before 3.4.18 mishandles a DECRQSS response. |
CVE-2022-41942 | High | 7.9 | 2022-11-22 | Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sour… |
CVE-2022-3388 | High | 8.8 | 2022-11-21 | An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administra… |
CVE-2022-45470 | High | 7.5 | 2022-11-21 | missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issue… |
CVE-2022-31616 | Medium | 6.1 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic… |
CVE-2022-31607 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause imprope… |
CVE-2022-41909 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `… |
CVE-2022-41908 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`… |
CVE-2022-41901 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail… |
CVE-2022-41899 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaO… |
CVE-2022-41898 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issu… |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41891 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which c… |
CVE-2022-41888 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must… |
CVE-2022-24037 | High | 8.2 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical informatio… |
CVE-2022-36784 | Critical | 9.8 | 2022-11-17 | Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics… |
CVE-2022-20459 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with S… |
CVE-2022-39389 | High | 8.2 | 2022-11-17 | Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a blo… |
CVE-2022-39318 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious serve… |
CVE-2022-38385 | High | 7.1 | 2022-11-15 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized a… |
CVE-2022-20924 | High | 7.7 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense… |
CVE-2022-40773 | High | 8.8 | 2022-11-12 | Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sen… |
CVE-2022-31772 | Medium | 5.3 | 2022-11-11 | IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels… |
CVE-2022-38099 | High | 7.5 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially en… |
CVE-2022-34152 | High | 7.7 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially ena… |
CVE-2022-33176 | High | 8.2 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before version PATGL357.0042 may… |
CVE-2022-30542 | High | 8.2 | 2022-11-11 | Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families be… |
CVE-2022-29466 | High | 7.3 | 2022-11-11 | Improper input validation in firmware for Intel(R) SPS before version SPS_E3_04.01.04.700.0 may allow an authenticated user to potentially enable denial of ser… |
CVE-2022-28611 | Medium | 6.8 | 2022-11-11 | Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |
CVE-2022-28126 | Medium | 6.0 | 2022-11-11 | Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |
CVE-2022-26047 | Medium | 4.3 | 2022-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potent… |
CVE-2022-26006 | High | 8.2 | 2022-11-11 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2021-26251 | Medium | 5.3 | 2022-11-11 | Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Toolkit may allow an authenticated user to potentially enable denial of service via netw… |
CVE-2021-0185 | High | 7.5 | 2022-11-10 | Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to potentially enable a… |