CWE-20 · Improper Input Validation (page 40)
Page 40 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26404 | Medium | 5.5 | 2023-01-11 | Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. |
CVE-2021-26316 | High | 7.8 | 2023-01-11 | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (… |
CVE-2023-22963 | Medium | 5.3 | 2023-01-11 | The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression. |
CVE-2023-21767 | High | 7.8 | 2023-01-10 | Windows Overlay Filter Elevation of Privilege Vulnerability |
CVE-2023-21749 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21559 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21558 | High | 7.8 | 2023-01-10 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2023-21550 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21540 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-0139 | Medium | 6.5 | 2023-01-10 | Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restric… |
CVE-2023-22898 | Medium | 6.5 | 2023-01-10 | workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP b… |
CVE-2022-33300 | High | 8.4 | 2023-01-09 | Memory corruption in Automotive Android OS due to improper input validation. |
CVE-2022-23549 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22465 | High | 7.5 | 2023-01-04 | Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and… |
CVE-2023-22460 | High | 7.5 | 2023-01-04 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |
CVE-2022-45875 | Critical | 9.8 | 2023-01-04 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache Do… |
CVE-2022-32653 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32652 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-22452 | Medium | 6.5 | 2023-01-02 | kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior… |
CVE-2022-42269 | High | 7.9 | 2022-12-30 | NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to ca… |
CVE-2022-34681 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-re… |
CVE-2022-39012 | High | 7.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. |
CVE-2020-36564 | High | 7.5 | 2022-12-27 | Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be… |
CVE-2022-43849 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of se… |
CVE-2022-43848 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial o… |
CVE-2022-40233 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of… |
CVE-2022-40898 | High | 7.5 | 2022-12-23 | An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled… |
CVE-2022-22184 | High | 7.5 | 2022-12-22 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated net… |
CVE-2022-34476 | Critical | 9.8 | 2022-12-22 | ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Fire… |
CVE-2022-22749 | Medium | 4.3 | 2022-12-22 | When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for… |
CVE-2022-44756 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged ac… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2022-46328 | High | 7.5 | 2022-12-20 | Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-43875 | Medium | 6.2 | 2022-12-20 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting… |
CVE-2022-25940 | High | 7.5 | 2022-12-20 | All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the d… |
CVE-2022-46401 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete. |
CVE-2022-3752 | High | 8.6 | 2022-12-19 | An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service conditio… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-26582 | High | 7.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attack… |
CVE-2022-3157 | High | 8.6 | 2022-12-16 | A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-o… |
CVE-2022-42534 | High | 7.8 | 2022-12-16 | In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible privilege escalation due to improper input validation. This could lead to local escalatio… |
CVE-2022-20592 | Medium | 5.5 | 2022-12-16 | In ppmp_validate_secbuf of drm_fw.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosu… |
CVE-2022-20590 | Medium | 5.5 | 2022-12-16 | In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input validation. This could lead to local inform… |
CVE-2022-20589 | Medium | 4.4 | 2022-12-16 | In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could lead to local information disclosure with… |
CVE-2022-20587 | High | 7.8 | 2022-12-16 | In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional… |
CVE-2022-20586 | High | 7.8 | 2022-12-16 | In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of… |
CVE-2022-20585 | High | 7.8 | 2022-12-16 | In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of… |
CVE-2022-20584 | High | 7.8 | 2022-12-16 | In page_number of shared_mem.c, there is a possible code execution in secure world due to improper input validation. This could lead to local escalation of pri… |
CVE-2022-20545 | High | 7.5 | 2022-12-16 | In bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input validation. This could lead to remote denia… |
CVE-2022-20512 | High | 7.8 | 2022-12-16 | In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to… |
CVE-2022-20507 | High | 7.8 | 2022-12-16 | In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds check. This could le… |
CVE-2021-28655 | Medium | 6.5 | 2022-12-16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue… |
CVE-2022-46701 | High | 7.8 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious… |
CVE-2022-42837 | Critical | 9.8 | 2022-12-15 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur… |
CVE-2022-46768 | Medium | 5.9 | 2022-12-15 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation… |
CVE-2022-4504 | High | 7.5 | 2022-12-15 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-43723 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly va… |
CVE-2022-20470 | High | 7.8 | 2022-12-13 | In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input validation. This cou… |
CVE-2021-44695 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-44694 | Medium | 5.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2021-40365 | High | 7.5 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2022-46363 | High | 7.5 | 2022-12-13 | A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability… |
CVE-2022-45871 | Medium | 4.3 | 2022-12-13 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP re… |
CVE-2022-45113 | Medium | 6.5 | 2022-12-07 | Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a r… |
CVE-2022-33876 | Medium | 5.4 | 2022-12-06 | Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allow… |
CVE-2022-38123 | High | 8.7 | 2022-12-06 | Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager i… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-43484 | High | 7.8 | 2022-12-05 | TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader ma… |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2022-1471 | High | 8.3 | 2022-12-01 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker ca… |
CVE-2022-40265 | High | 8.6 | 2022-11-30 | Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric… |
CVE-2022-4186 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-4033 | Medium | 5.3 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0… |
CVE-2022-4032 | High | 7.2 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due… |
CVE-2022-36960 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to e… |
CVE-2022-41921 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial o… |
CVE-2022-38900 | High | 7.5 | 2022-11-28 | decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-39338 | Low | 3.5 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross si… |
CVE-2022-40266 | Medium | 5.3 | 2022-11-24 | Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 S… |
CVE-2022-45872 | Critical | 9.8 | 2022-11-23 | iTerm2 before 3.4.18 mishandles a DECRQSS response. |
CVE-2022-41942 | High | 7.9 | 2022-11-22 | Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sour… |
CVE-2022-3388 | High | 8.8 | 2022-11-21 | An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administra… |
CVE-2022-45470 | High | 7.5 | 2022-11-21 | missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issue… |
CVE-2022-31616 | Medium | 6.1 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic… |
CVE-2022-31607 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause imprope… |
CVE-2022-41909 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `… |
CVE-2022-41908 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`… |
CVE-2022-41901 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail… |
CVE-2022-41899 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaO… |
CVE-2022-41898 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issu… |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41891 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which c… |
CVE-2022-41888 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must… |
CVE-2022-24037 | High | 8.2 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical informatio… |
CVE-2022-36784 | Critical | 9.8 | 2022-11-17 | Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics… |
CVE-2022-20459 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with S… |
CVE-2022-39389 | High | 8.2 | 2022-11-17 | Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a blo… |
CVE-2022-39318 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious serve… |