CWE-20 · Improper Input Validation (page 41)
Page 41 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28711 | Critical | 9.8 | 2022-04-14 | A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177cb9. A specially-cr… |
CVE-2021-44394 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44375 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44366 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44357 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44356 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44355 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2021-44354 | High | 7.5 | 2022-04-14 | Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-cr… |
CVE-2022-24847 | High | 7.2 | 2022-04-13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform a… |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2022-24818 | High | 8.2 | 2022-04-13 | GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked J… |
CVE-2022-27655 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicatio… |
CVE-2022-27654 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applica… |
CVE-2022-26109 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26108 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-26107 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the a… |
CVE-2022-26106 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-28329 | Medium | 6.5 | 2022-04-12 | A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (Al… |
CVE-2022-28328 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (Al… |
CVE-2022-25751 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-1302 | High | 7.5 | 2022-04-12 | In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service. |
CVE-2022-27843 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code. |
CVE-2022-27842 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code. |
CVE-2022-27835 | High | 7.6 | 2022-04-11 | Improper boundary check in UWB firmware prior to SMR Apr-2022 Release 1 allows arbitrary memory write. |
CVE-2022-27833 | Medium | 4.4 | 2022-04-11 | Improper input validation in DSP driver prior to SMR Apr-2022 Release 1 allows out-of-bounds write by integer overflow. |
CVE-2022-27830 | High | 8.5 | 2022-04-11 | Improper validation vulnerability in SemBlurInfo prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-27829 | High | 8.5 | 2022-04-11 | Improper validation vulnerability in VerifyCredentialResponse prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-27828 | High | 8.5 | 2022-04-11 | Improper validation vulnerability in MediaMonitorEvent prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-27827 | High | 8.5 | 2022-04-11 | Improper validation vulnerability in MediaMonitorDimension prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-27826 | High | 8.5 | 2022-04-11 | Improper validation vulnerability in SemSuspendDialogInfo prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-27574 | Medium | 4.4 | 2022-04-11 | Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of b… |
CVE-2022-27573 | Medium | 4.4 | 2022-04-11 | Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of b… |
CVE-2021-4047 | High | 7.5 | 2022-04-11 | The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red H… |
CVE-2022-25595 | Medium | 6.5 | 2022-04-07 | ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a ser… |
CVE-2022-20784 | Medium | 5.8 | 2022-04-06 | A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated… |
CVE-2020-29013 | Medium | 5.4 | 2022-04-06 | An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniff… |
CVE-2022-1243 | Medium | 6.1 | 2022-04-05 | CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2021-32974 | Critical | 9.8 | 2022-04-01 | Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute c… |
CVE-2021-32970 | High | 7.5 | 2022-04-01 | Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote at… |
CVE-2021-26624 | High | 7.8 | 2022-04-01 | An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient e… |
CVE-2021-22277 | High | 7.5 | 2022-04-01 | Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Sof… |
CVE-2022-22311 | Medium | 6.5 | 2022-03-31 | IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to i… |
CVE-2022-24299 | High | 8.8 | 2022-03-31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to… |
CVE-2021-39778 | Medium | 5.5 | 2022-03-30 | In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation. This could lead to… |
CVE-2021-39771 | High | 7.8 | 2022-03-30 | In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input validation. This could lead to local escalatio… |
CVE-2021-39764 | High | 7.8 | 2022-03-30 | In Settings, there is a possible way to display an incorrect app name due to improper input validation. This could lead to local escalation of privilege via ap… |
CVE-2021-39763 | High | 7.8 | 2022-03-30 | In Settings, there is a possible way to make the user enable WiFi due to improper input validation. This could lead to local escalation of privilege with no ad… |
CVE-2021-39740 | Medium | 5.5 | 2022-03-30 | In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation. This could lead to local information disclosure with… |
CVE-2022-25757 | Critical | 9.8 | 2022-03-28 | In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a d… |
CVE-2021-44462 | High | 7.8 | 2022-03-25 | This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues resul… |
CVE-2021-3567 | High | 7.5 | 2022-03-25 | A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Cari… |
CVE-2021-3422 | High | 7.5 | 2022-03-25 | The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index… |
CVE-2021-35254 | High | 8.2 | 2022-03-25 | SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent t… |
CVE-2021-26622 | Critical | 9.6 | 2022-03-25 | An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers… |
CVE-2022-21820 | Medium | 6.3 | 2022-03-24 | NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited co… |
CVE-2022-0551 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manage… |
CVE-2022-0550 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report… |
CVE-2021-4219 | Medium | 5.5 | 2022-03-23 | A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker… |
CVE-2021-27420 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming… |
CVE-2021-27418 | Medium | 5.3 | 2022-03-23 | GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possibl… |
CVE-2021-44040 | High | 7.5 | 2022-03-23 | Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache… |
CVE-2022-27228 | Critical | 9.8 | 2022-03-22 | In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. |
CVE-2022-24774 | High | 7.1 | 2022-03-22 | CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version… |
CVE-2022-24775 | High | 7.5 | 2022-03-21 | guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new… |
CVE-2022-0415 | High | 8.8 | 2022-03-21 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. |
CVE-2022-22588 | Medium | 5.5 | 2022-03-18 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 15.2.1 and iPadOS 15.2.1. Processing a maliciously crafted… |
CVE-2021-39701 | High | 7.8 | 2022-03-16 | In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foreground without notification or permission d… |
CVE-2020-25721 | High | 8.8 | 2022-03-16 | Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable S… |
CVE-2022-25839 | Medium | 4.3 | 2022-03-11 | The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed… |
CVE-2018-25031 | Medium | 4.3 | 2022-03-11 | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit… |
CVE-2021-38910 | Medium | 5.3 | 2022-03-10 | IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By… |
CVE-2022-26100 | Critical | 9.8 | 2022-03-10 | SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obta… |
CVE-2022-25818 | Medium | 6.5 | 2022-03-10 | Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution. |
CVE-2021-42857 | Medium | 5.3 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInte… |
CVE-2021-42856 | Medium | 4.7 | 2022-03-10 | It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any… |
CVE-2021-42854 | Critical | 9.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInter… |
CVE-2021-42853 | Critical | 9.1 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/a… |
CVE-2021-42787 | Critical | 9.4 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/… |
CVE-2021-42786 | Critical | 9.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API re… |
CVE-2021-20302 | Medium | 5.5 | 2022-03-04 | A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by Open… |
CVE-2022-26336 | Medium | 5.5 | 2022-03-04 | A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF file… |
CVE-2022-24723 | Medium | 5.3 | 2022-03-03 | URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not p… |
CVE-2021-23192 | High | 7.5 | 2022-03-02 | A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker c… |
CVE-2022-0675 | Medium | 5.6 | 2022-03-02 | In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This… |
CVE-2022-24720 | Critical | 9.8 | 2022-03-01 | image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_proce… |
CVE-2021-32586 | High | 7.7 | 2022-03-01 | An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the enviro… |
CVE-2020-15936 | Low | 2.6 | 2022-03-01 | A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows a… |
CVE-2022-24711 | Critical | 9.4 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attack… |
CVE-2021-26617 | High | 8.1 | 2022-02-25 | This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code… |
CVE-2022-20624 | High | 8.6 | 2022-02-23 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2021-26618 | High | 7.1 | 2022-02-18 | An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitr… |
CVE-2020-25717 | High | 8.1 | 2022-02-18 | A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. |
CVE-2021-4120 | High | 8.2 | 2022-02-17 | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor… |
CVE-2022-20750 | Medium | 5.3 | 2022-02-17 | A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticat… |
CVE-2022-25271 | High | 7.5 | 2022-02-16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2021-3781 | Critical | 9.9 | 2022-02-16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This… |
CVE-2022-24086 | Critical | 9.8 | 2022-02-16 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout proces… |
CVE-2022-23992 | Critical | 9.8 | 2022-02-14 | XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote… |
CVE-2022-24926 | Medium | 5.7 | 2022-02-11 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-24925 | Medium | 4.4 | 2022-02-11 | Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial of service attack… |