CWE-20 · Improper Input Validation (page 37)
Page 37 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39881 | Medium | 5.3 | 2022-11-09 | Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows remote attacker to read out of bounds me… |
CVE-2022-39880 | High | 7.1 | 2022-11-09 | Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary code execution. |
CVE-2022-39306 | Medium | 6.4 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Valida… |
CVE-2022-44553 | Medium | 5.3 | 2022-11-09 | The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. Successful exploita… |
CVE-2022-27674 | High | 7.5 | 2022-11-09 | Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel cra… |
CVE-2022-23831 | High | 7.5 | 2022-11-09 | Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash re… |
CVE-2022-45060 | High | 7.5 | 2022-11-09 | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce ch… |
CVE-2022-41214 | High | 8.7 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-20457 | Medium | 5.5 | 2022-11-08 | In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead… |
CVE-2022-44556 | High | 7.5 | 2022-11-08 | Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-43546 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43545 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43439 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All ver… |
CVE-2022-43566 | High | 7.3 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass… |
CVE-2022-43565 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL s… |
CVE-2022-43563 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky… |
CVE-2022-43562 | Low | 3.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote… |
CVE-2022-43449 | Medium | 6.2 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the… |
CVE-2022-40276 | Medium | 5.5 | 2022-11-03 | Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through… |
CVE-2022-40235 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper input validation. I… |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-39376 | Low | 2.6 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-3181 | High | 7.5 | 2022-11-02 | An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affecte… |
CVE-2022-39353 | Critical | 9.4 | 2022-11-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because… |
CVE-2022-3661 | Medium | 4.3 | 2022-11-01 | Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2022-3656 | High | 8.8 | 2022-11-01 | Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted… |
CVE-2022-42800 | High | 7.8 | 2022-11-01 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macO… |
CVE-2022-3444 | Medium | 4.3 | 2022-11-01 | Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a craf… |
CVE-2022-22658 | Medium | 6.5 | 2022-11-01 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 16.0.3. Processing a maliciously crafted email message may l… |
CVE-2022-25885 | High | 7.5 | 2022-11-01 | The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid d… |
CVE-2022-39017 | High | 8.2 | 2022-10-31 | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-… |
CVE-2022-39016 | High | 8.2 | 2022-10-31 | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. |
CVE-2022-28763 | High | 8.8 | 2022-10-31 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious… |
CVE-2022-0073 | High | 8.8 | 2022-10-27 | Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This a… |
CVE-2022-3095 | Critical | 9.8 | 2022-10-27 | The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standar… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2022-42468 | Critical | 9.8 | 2022-10-26 | Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe provide… |
CVE-2022-20822 | High | 7.1 | 2022-10-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete… |
CVE-2022-33178 | High | 7.2 | 2022-10-25 | A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code o… |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-38435 | High | 7.8 | 2022-10-25 | Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrar… |
CVE-2022-3676 | Medium | 6.5 | 2022-10-24 | In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to acc… |
CVE-2021-44769 | Medium | 4.9 | 2022-10-24 | An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) condition which can… |
CVE-2022-39259 | Low | 3.3 | 2022-10-21 | jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of S… |
CVE-2022-41836 | High | 7.5 | 2022-10-19 | When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to term… |
CVE-2022-41813 | Medium | 6.5 | 2022-10-19 | In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module… |
CVE-2022-41694 | Medium | 4.9 | 2022-10-19 | In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and a… |
CVE-2022-1414 | High | 8.8 | 2022-10-19 | 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and… |
CVE-2022-22247 | High | 7.5 | 2022-10-18 | An Improper Input Validation vulnerability in ingress TCP segment processing of Juniper Networks Junos OS Evolved allows a network-based unauthenticated attack… |
CVE-2022-22243 | Medium | 4.3 | 2022-10-18 | An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to add a… |
CVE-2022-22241 | High | 8.1 | 2022-10-18 | An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without pro… |
CVE-2022-22230 | Medium | 6.5 | 2022-10-18 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenti… |
CVE-2022-22228 | High | 7.5 | 2022-10-18 | An Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS allows an attacker to cause a… |
CVE-2022-22223 | Medium | 6.5 | 2022-10-18 | On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping (PHP) nodes with link aggregation group (… |
CVE-2022-22201 | High | 7.5 | 2022-10-18 | An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows… |
CVE-2022-22192 | High | 7.5 | 2022-10-18 | An Improper Validation of Syntactic Correctness of Input vulnerability in the kernel of Juniper Networks Junos OS Evolved on PTX series allows a network-based… |
CVE-2022-23770 | High | 8.8 | 2022-10-17 | This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attacker… |
CVE-2017-7517 | Low | 3.5 | 2022-10-17 | An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a… |
CVE-2022-42340 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in ar… |
CVE-2022-38985 | High | 7.5 | 2022-10-14 | The facial recognition module has a vulnerability in input validation.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-3171 | Medium | 4.3 | 2022-10-12 | A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inp… |
CVE-2022-32489 | High | 8.2 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32488 | High | 8.2 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32487 | High | 7.5 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32485 | High | 7.5 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32484 | Medium | 5.6 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2022-32483 | Medium | 5.6 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2022-41606 | Medium | 6.5 | 2022-10-12 | HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash cli… |
CVE-2022-3140 | Medium | 6.3 | 2022-10-11 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |
CVE-2022-32492 | High | 7.5 | 2022-10-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32486 | High | 7.5 | 2022-10-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-40227 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP Mobile Panels (All ver… |
CVE-2022-36363 | Medium | 5.3 | 2022-10-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2022-36362 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo… |
CVE-2022-31766 | High | 8.6 | 2022-10-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2022-42012 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-39281 | Medium | 6.5 | 2022-10-08 | fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform… |
CVE-2022-39291 | Medium | 5.4 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows u… |
CVE-2022-32591 | High | 7.5 | 2022-10-07 | In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges… |
CVE-2022-39863 | Low | 3.6 | 2022-10-07 | Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission. |
CVE-2022-36868 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device. |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-40923 | Medium | 6.5 | 2022-09-30 | A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segm… |
CVE-2022-20945 | High | 7.4 | 2022-09-30 | A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker… |
CVE-2022-20850 | Medium | 5.5 | 2022-09-30 | A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitra… |
CVE-2022-40277 | High | 7.8 | 2022-09-30 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Jopli… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-39232 | Medium | 6.5 | 2022-09-29 | Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaSc… |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-39266 | Critical | 9.6 | 2022-09-29 | isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is pass… |
CVE-2014-0144 | High | 8.6 | 2022-09-29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overf… |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-39236 | Medium | 4.3 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede… |
CVE-2022-36448 | High | 8.2 | 2022-09-28 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the Pnp… |
CVE-2022-22525 | High | 7.2 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due… |
CVE-2022-3201 | Medium | 5.4 | 2022-09-26 | Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to instal… |
CVE-2022-3075 | Critical | 9.6 | 2022-09-26 | Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2022-2856 | Medium | 6.5 | 2022-09-26 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a… |
CVE-2022-35893 | High | 8.2 | 2022-09-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an a… |
CVE-2022-32797 | High | 7.1 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing… |