CWE-20 · Improper Input Validation (page 42)
Page 42 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20850 | Medium | 5.5 | 2022-09-30 | A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitra… |
CVE-2022-40277 | High | 7.8 | 2022-09-30 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Jopli… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-39232 | Medium | 6.5 | 2022-09-29 | Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaSc… |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-39266 | Critical | 9.6 | 2022-09-29 | isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is pass… |
CVE-2014-0144 | High | 8.6 | 2022-09-29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overf… |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-39236 | Medium | 4.3 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede… |
CVE-2022-36448 | High | 8.2 | 2022-09-28 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the Pnp… |
CVE-2022-22525 | High | 7.2 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due… |
CVE-2022-3201 | Medium | 5.4 | 2022-09-26 | Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to instal… |
CVE-2022-3075 | Critical | 9.6 | 2022-09-26 | Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2022-2856 | Medium | 6.5 | 2022-09-26 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a… |
CVE-2022-35893 | High | 8.2 | 2022-09-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an a… |
CVE-2022-32797 | High | 7.1 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing… |
CVE-2022-32786 | Medium | 5.5 | 2022-09-23 | An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big S… |
CVE-2022-32226 | Medium | 4.3 | 2022-09-23 | An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not typ… |
CVE-2022-26707 | Medium | 5.5 | 2022-09-23 | An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in macOS Monterey 12.4. A user may be able to vie… |
CVE-2022-22423 | Medium | 5.5 | 2022-09-23 | IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper inp… |
CVE-2022-35252 | Low | 3.7 | 2022-09-23 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver migh… |
CVE-2022-24280 | Medium | 6.5 | 2022-09-23 | Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsa… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2022-35896 | Medium | 6.0 | 2022-09-22 | An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents… |
CVE-2022-37395 | High | 7.5 | 2022-09-20 | A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions includ… |
CVE-2022-23766 | High | 7.8 | 2022-09-19 | An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed… |
CVE-2022-36027 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaul… |
CVE-2022-36017 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` t… |
CVE-2022-35986 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be u… |
CVE-2022-35982 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a v… |
CVE-2022-35979 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_featur… |
CVE-2022-35974 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it result… |
CVE-2022-35973 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a… |
CVE-2022-35972 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzer… |
CVE-2022-35970 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a s… |
CVE-2022-35967 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a se… |
CVE-2022-35966 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in… |
CVE-2022-35964 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a seg… |
CVE-2021-40017 | Critical | 9.8 | 2022-09-16 | The HW_KEYMASTER module lacks the validity check of the key format. Successful exploitation of this vulnerability may result in out-of-bounds memory access. |
CVE-2022-38408 | High | 7.8 | 2022-09-16 | Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrar… |
CVE-2022-35415 | High | 7.8 | 2022-09-16 | An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2022-1798 | High | 8.7 | 2022-09-15 | A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary fil… |
CVE-2022-3001 | High | 7.5 | 2022-09-15 | This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s… |
CVE-2022-29922 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC… |
CVE-2022-29492 | Medium | 5.3 | 2022-09-14 | Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upo… |
CVE-2022-20392 | High | 7.8 | 2022-09-13 | In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper inpu… |
CVE-2022-36087 | Medium | 5.7 | 2022-09-09 | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redir… |
CVE-2021-40648 | Medium | 5.5 | 2022-09-09 | In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current… |
CVE-2022-3169 | Medium | 5.5 | 2022-09-09 | A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RE… |
CVE-2022-36873 | Medium | 5.9 | 2022-09-09 | Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected B… |
CVE-2022-36859 | Medium | 5.7 | 2022-09-09 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-36854 | Medium | 4.0 | 2022-09-09 | Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information. |
CVE-2022-36853 | Low | 3.3 | 2022-09-09 | Intent redirection in Photo Editor prior to SMR Sep-2022 Release 1 allows attacker to get sensitive information. |
CVE-2022-36850 | Medium | 4.0 | 2022-09-09 | Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid. |
CVE-2022-36085 | High | 7.4 | 2022-09-08 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows… |
CVE-2022-36082 | Medium | 5.3 | 2022-09-07 | mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http… |
CVE-2022-36058 | High | 7.5 | 2022-09-06 | Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or act… |
CVE-2022-36032 | Medium | 5.3 | 2022-09-06 | ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to… |
CVE-2022-31020 | High | 8.8 | 2022-09-06 | Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request hand… |
CVE-2022-30331 | High | 8.8 | 2022-09-05 | The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequentl… |
CVE-2021-35122 | Critical | 9.3 | 2022-09-02 | Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2021-35109 | Medium | 6.8 | 2022-09-02 | Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mo… |
CVE-2022-28199 | Medium | 6.5 | 2022-09-01 | NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly… |
CVE-2022-1271 | High | 8.8 | 2022-08-31 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted f… |
CVE-2021-3754 | Medium | 5.3 | 2022-08-26 | A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble… |
CVE-2022-29850 | High | 8.1 | 2022-08-26 | Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. |
CVE-2021-4204 | High | 7.1 | 2022-08-24 | An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a sp… |
CVE-2021-4125 | High | 8.1 | 2022-08-24 | It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup… |
CVE-2021-4041 | High | 7.8 | 2022-08-24 | A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters g… |
CVE-2020-35509 | Medium | 5.4 | 2022-08-23 | A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missin… |
CVE-2021-3442 | Medium | 5.4 | 2022-08-22 | A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text b… |
CVE-2022-34916 | Critical | 9.8 | 2022-08-21 | Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data… |
CVE-2022-34345 | Medium | 6.2 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-33209 | High | 7.8 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-23403 | Medium | 5.5 | 2022-08-18 | Improper input validation in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of servi… |
CVE-2022-21212 | Medium | 6.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacen… |
CVE-2022-21197 | High | 7.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network… |
CVE-2022-21181 | High | 7.8 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of p… |
CVE-2021-44545 | Medium | 6.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enable denial of… |
CVE-2022-36023 | High | 7.0 | 2022-08-18 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2021-26639 | High | 8.1 | 2022-08-17 | This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerabili… |
CVE-2020-1756 | High | 7.2 | 2022-08-16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. |
CVE-2022-35239 | High | 8.8 | 2022-08-16 | The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verifica… |
CVE-2022-24952 | Medium | 6.5 | 2022-08-16 | Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number an… |
CVE-2022-2618 | Medium | 6.5 | 2022-08-12 | Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a… |
CVE-2022-20338 | Low | 3.3 | 2022-08-12 | In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local e… |
CVE-2022-20314 | Medium | 6.7 | 2022-08-12 | In KeyChain, there is a possible spoof keychain chooser activity request due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2022-20266 | Medium | 5.0 | 2022-08-12 | In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input… |
CVE-2022-35668 | Medium | 5.5 | 2022-08-11 | Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an Improper Input Validatio… |
CVE-2022-35666 | High | 7.8 | 2022-08-11 | Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an Improper Input Validatio… |
CVE-2022-28755 | Critical | 9.6 | 2022-08-11 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious… |
CVE-2022-20241 | Low | 3.3 | 2022-08-11 | In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation. This could lead to local information disclos… |
CVE-2021-22289 | High | 8.3 | 2022-08-11 | Improper Input Validation vulnerability in the project upload mechanism in B&R Automation Studio version >=4.0 may allow an unauthenticated network attacker to… |
CVE-2022-20356 | High | 7.8 | 2022-08-10 | In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input v… |
CVE-2022-20355 | Medium | 5.5 | 2022-08-10 | In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User… |
CVE-2022-20353 | Medium | 5.5 | 2022-08-10 | In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation. This could lead to local inf… |
CVE-2022-20350 | Medium | 5.5 | 2022-08-10 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to im… |
CVE-2022-20842 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2022-20841 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |