CWE-20 · Improper Input Validation (page 39)
Page 39 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29154 | High | 7.4 | 2022-08-02 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The ser… |
CVE-2022-31321 | Critical | 9.1 | 2022-08-01 | The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial… |
CVE-2022-34164 | Medium | 5.5 | 2022-08-01 | IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. IBM X-Force ID: 229338. |
CVE-2022-27255 | Critical | 9.8 | 2022-08-01 | In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remote… |
CVE-2022-37010 | Low | 3.6 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed |
CVE-2022-2479 | Medium | 4.3 | 2022-07-28 | Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a user to install a ma… |
CVE-2020-6998 | Medium | 5.8 | 2022-07-27 | The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage… |
CVE-2022-1500 | Medium | 6.5 | 2022-07-26 | Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2022-35650 | High | 7.5 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary… |
CVE-2022-35649 | Critical | 9.8 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote… |
CVE-2022-36450 | High | 8.0 | 2022-07-25 | Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. |
CVE-2022-31172 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChec… |
CVE-2022-31170 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `… |
CVE-2022-20913 | Medium | 4.9 | 2022-07-22 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is du… |
CVE-2022-20909 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20908 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-22214 | Medium | 6.5 | 2022-07-20 | An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker… |
CVE-2022-34866 | High | 7.8 | 2022-07-20 | Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess com… |
CVE-2022-35404 | High | 8.2 | 2022-07-18 | ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine. |
CVE-2022-26655 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams. |
CVE-2022-34758 | Medium | 5.1 | 2022-07-13 | A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged… |
CVE-2022-35171 | Medium | 5.5 | 2022-07-12 | When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and… |
CVE-2022-32248 | Medium | 5.3 | 2022-07-12 | Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the… |
CVE-2022-2385 | High | 8.1 | 2022-07-12 | A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. |
CVE-2022-33710 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Gal… |
CVE-2022-33709 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33708 | High | 7.8 | 2022-07-12 | Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy… |
CVE-2022-33704 | High | 8.5 | 2022-07-12 | Improper validation vulnerability in ucmRetParcelable of KnoxSDK prior to SMR Jul-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-33703 | High | 8.5 | 2022-07-12 | Improper validation vulnerability in CACertificateInfo prior to SMR Jul-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-33690 | Medium | 4.0 | 2022-07-12 | Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file. |
CVE-2022-30756 | High | 8.5 | 2022-07-12 | Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder. |
CVE-2022-30754 | High | 8.5 | 2022-07-12 | Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of AppL… |
CVE-2021-44221 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The affected systems do not properly validate input that is sent to… |
CVE-2020-35169 | Critical | 9.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulne… |
CVE-2020-29508 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnera… |
CVE-2020-29507 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation Vulnera… |
CVE-2022-2047 | Low | 2.7 | 2022-07-07 | In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme UR… |
CVE-2022-31121 | High | 7.5 | 2022-07-07 | Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer… |
CVE-2022-29892 | Medium | 6.5 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain… |
CVE-2022-28692 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler. |
CVE-2022-27807 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories. |
CVE-2022-27803 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space. |
CVE-2022-28127 | Critical | 9.1 | 2022-06-30 | A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead t… |
CVE-2013-4144 | Critical | 9.8 | 2022-06-30 | There is an object injection vulnerability in swfupload plugin for wordpress. |
CVE-2022-2145 | Medium | 5.8 | 2022-06-28 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client… |
CVE-2022-31036 | Medium | 4.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bu… |
CVE-2022-26864 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26863 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26862 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-32534 | High | 8.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web inte… |
CVE-2022-33754 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33752 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2021-3675 | Medium | 5.5 | 2022-06-16 | Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with… |
CVE-2022-21180 | Medium | 5.5 | 2022-06-15 | Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. |
CVE-2022-32154 | Medium | 6.8 | 2022-06-15 | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a… |
CVE-2022-20205 | Medium | 5.5 | 2022-06-15 | In isFileUri of FileUtil.java, there is a possible way to bypass the check for a file:// scheme due to improper input validation. This could lead to local info… |
CVE-2022-20186 | High | 7.8 | 2022-06-15 | In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalatio… |
CVE-2022-20156 | High | 7.8 | 2022-06-15 | In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privil… |
CVE-2022-20134 | High | 7.8 | 2022-06-15 | In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This cou… |
CVE-2022-20129 | Medium | 5.5 | 2022-06-15 | In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to improper input validat… |
CVE-2022-32243 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatio… |
CVE-2022-32242 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashe… |
CVE-2022-32241 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applic… |
CVE-2022-32240 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32239 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and… |
CVE-2022-32238 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32237 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appl… |
CVE-2022-32236 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes a… |
CVE-2022-32235 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2022-32253 | Medium | 4.9 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password… |
CVE-2021-35116 | High | 7.7 | 2022-06-14 | APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-35111 | High | 7.5 | 2022-06-14 | Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2021-35092 | Medium | 6.7 | 2022-06-14 | Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-30338 | High | 7.1 | 2022-06-14 | Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute |
CVE-2022-25167 | Critical | 9.8 | 2022-06-14 | Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data s… |
CVE-2022-29257 | Medium | 6.6 | 2022-06-13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta… |
CVE-2022-31762 | High | 7.8 | 2022-06-13 | The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-31041 | High | 7.6 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be conf… |
CVE-2022-28383 | Medium | 6.8 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code f… |
CVE-2021-35531 | Medium | 6.7 | 2022-06-07 | Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with acc… |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30726 | Medium | 6.2 | 2022-06-07 | Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attackers to launch activ… |
CVE-2022-30721 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30720 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30719 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30713 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30712 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30711 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30710 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30709 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2022-30233 | Medium | 6.5 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing ce… |
CVE-2022-30232 | High | 8.0 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a re… |
CVE-2022-25163 | Critical | 9.8 | 2022-06-02 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electri… |
CVE-2022-29169 | High | 7.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expr… |
CVE-2020-26185 | High | 7.5 | 2022-06-01 | Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability. |
CVE-2022-31013 | Critical | 9.1 | 2022-05-31 | Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token… |
CVE-2022-29243 | Medium | 4.3 | 2022-05-31 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size valida… |
CVE-2022-20797 | Medium | 5.5 | 2022-05-27 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated… |
CVE-2022-30789 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. |