CWE-20 · Improper Input Validation (page 40)
Page 40 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30788 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. |
CVE-2022-30786 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. |
CVE-2022-30784 | High | 7.8 | 2022-05-26 | A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. |
CVE-2022-24418 | High | 7.5 | 2022-05-26 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24417 | High | 7.5 | 2022-05-26 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-26531 | Medium | 6.1 | 2022-05-24 | Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series f… |
CVE-2022-29213 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the `tf.compat.v1.signal.rfft2d` and `tf.compat.v… |
CVE-2022-29212 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFL… |
CVE-2022-29211 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.histogram_fixed_width`… |
CVE-2022-29206 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorDen… |
CVE-2022-29204 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegment… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29201 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D… |
CVE-2022-29207 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager… |
CVE-2022-29200 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell`… |
CVE-2022-29199 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMat… |
CVE-2022-29198 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToC… |
CVE-2022-29197 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegment… |
CVE-2022-29196 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropF… |
CVE-2022-29195 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does… |
CVE-2022-29193 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2… |
CVE-2022-29194 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTe… |
CVE-2022-29192 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequ… |
CVE-2022-29191 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTenso… |
CVE-2022-24905 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that… |
CVE-2022-29872 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow a… |
CVE-2021-26631 | High | 8.0 | 2022-05-19 | Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerabilit… |
CVE-2021-26630 | High | 7.8 | 2022-05-19 | Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be… |
CVE-2022-25162 | Medium | 5.3 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-25161 | High | 8.6 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-1727 | High | 8.8 | 2022-05-18 | Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-28190 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validati… |
CVE-2022-28188 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2022-28186 | Medium | 6.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2021-33025 | Medium | 5.6 | 2022-05-16 | xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges. |
CVE-2021-26351 | Medium | 5.5 | 2022-05-12 | Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid DRAM address that co… |
CVE-2022-26782 | High | 8.8 | 2022-05-12 | Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-craf… |
CVE-2022-26781 | High | 8.8 | 2022-05-12 | Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-craf… |
CVE-2022-26780 | High | 8.8 | 2022-05-12 | Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-craf… |
CVE-2022-24382 | Medium | 6.7 | 2022-05-12 | Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-21136 | Medium | 5.5 | 2022-05-12 | Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access. |
CVE-2021-33108 | Medium | 6.7 | 2022-05-12 | Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of… |
CVE-2021-0159 | High | 7.8 | 2022-05-12 | Improper input validation in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of p… |
CVE-2021-0154 | High | 7.8 | 2022-05-12 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via loca… |
CVE-2021-0126 | High | 8.0 | 2022-05-12 | Improper input validation for the Intel(R) Manageability Commander before version 2.2 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2021-33316 | Critical | 9.8 | 2022-05-11 | The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp relat… |
CVE-2021-33315 | Critical | 9.8 | 2022-05-11 | The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp relat… |
CVE-2021-26373 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possib… |
CVE-2022-29897 | Critical | 9.1 | 2022-05-11 | On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with ro… |
CVE-2022-29613 | Medium | 4.3 | 2022-05-11 | Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful e… |
CVE-2022-1406 | Medium | 6.5 | 2022-05-11 | Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Deve… |
CVE-2022-1431 | Medium | 4.3 | 2022-05-10 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions st… |
CVE-2021-46771 | High | 7.8 | 2022-05-10 | Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user… |
CVE-2021-26370 | High | 7.1 | 2022-05-10 | Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to o… |
CVE-2022-30330 | Medium | 6.6 | 2022-05-07 | In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using… |
CVE-2022-24098 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that c… |
CVE-2021-27760 | Medium | 4.6 | 2022-05-06 | An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execut… |
CVE-2022-26889 | High | 8.8 | 2022-05-06 | In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker t… |
CVE-2022-1053 | Critical | 9.1 | 2022-05-06 | Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for val… |
CVE-2021-25746 | High | 7.6 | 2022-05-06 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in… |
CVE-2021-25745 | High | 7.6 | 2022-05-06 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an… |
CVE-2022-29479 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and… |
CVE-2022-28708 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is con… |
CVE-2022-28695 | High | 7.2 | 2022-05-05 | On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5… |
CVE-2022-27634 | Medium | 6.5 | 2022-05-05 | On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated att… |
CVE-2022-22433 | High | 7.5 | 2022-05-05 | IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A… |
CVE-2022-20779 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-28791 | Medium | 6.2 | 2022-05-03 | Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path… |
CVE-2022-28783 | Medium | 6.2 | 2022-05-03 | Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permissi… |
CVE-2022-28781 | High | 7.7 | 2022-05-03 | Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds prope… |
CVE-2022-20745 | High | 8.6 | 2022-05-03 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def… |
CVE-2022-20715 | High | 8.6 | 2022-05-03 | A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software cou… |
CVE-2022-21144 | High | 7.5 | 2022-05-01 | This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .t… |
CVE-2021-41945 | Critical | 9.1 | 2022-04-28 | Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. |
CVE-2022-28196 | Medium | 4.6 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusted data may allow a… |
CVE-2022-28195 | Medium | 5.7 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrusted data may allow a h… |
CVE-2022-28193 | Medium | 5.6 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where insufficient validation of untrusted data may allow a loca… |
CVE-2022-24881 | High | 8.8 | 2022-04-26 | Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code exec… |
CVE-2022-29499 | Critical | 9.8 | 2022-04-26 | The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Applia… |
CVE-2022-1108 | Medium | 6.7 | 2022-04-22 | A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an at… |
CVE-2022-1107 | Medium | 6.7 | 2022-04-22 | During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad… |
CVE-2021-4212 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local acce… |
CVE-2021-4211 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow… |
CVE-2021-4210 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker… |
CVE-2021-3970 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local acc… |
CVE-2022-24423 | Medium | 5.3 | 2022-04-21 | Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabil… |
CVE-2022-20783 | High | 7.5 | 2022-04-21 | A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unau… |
CVE-2022-24861 | Critical | 9.9 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are n… |
CVE-2022-0567 | Critical | 9.1 | 2022-04-20 | A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing in… |
CVE-2021-26626 | High | 8.1 | 2022-04-19 | Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowse… |
CVE-2021-3624 | High | 7.8 | 2022-04-18 | There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in t… |
CVE-2022-27421 | High | 7.2 | 2022-04-15 | Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. |
CVE-2021-44483 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to eb_div in sr_port/eb_muldiv.c allows attackers to crash t… |
CVE-2021-44482 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to atte… |
CVE-2021-44481 | High | 7.5 | 2022-04-15 | An issue was discovered in YottaDB through r1.32 and V7.0-000. A lack of parameter validation in calls to memcpy in check_and_set_timeout in sr_unix/ztimeoutro… |
CVE-2022-20761 | High | 7.4 | 2022-04-15 | A vulnerability in the integrated wireless access point (AP) packet processing of the Cisco 1000 Series Connected Grid Router (CGR1K) could allow an unauthenti… |
CVE-2022-20684 | High | 7.4 | 2022-04-15 | A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of Cisco IOS XE Wireless Controller Software for the Catalyst… |
CVE-2022-20679 | Medium | 6.8 | 2022-04-15 | A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload… |
CVE-2022-20676 | Medium | 5.1 | 2022-04-15 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege… |
CVE-2022-24846 | Critical | 9.1 | 2022-04-14 | GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used… |