CWE-20 · Improper Input Validation (page 43)
Page 43 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44368 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44367 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44365 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44364 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44363 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44362 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44361 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44360 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44359 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2021-44358 | High | 7.7 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HT… |
CVE-2022-21796 | High | 8.2 | 2022-01-28 | A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP re… |
CVE-2021-40423 | High | 7.5 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted ser… |
CVE-2021-22827 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2021-22826 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2021-29845 | High | 8.8 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255. |
CVE-2022-23019 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virt… |
CVE-2022-23014 | Medium | 6.5 | 2022-01-25 | On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause th… |
CVE-2021-45223 | Medium | 6.5 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service attacks via forced s… |
CVE-2021-43588 | Medium | 4.3 | 2022-01-24 | Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit… |
CVE-2021-36343 | High | 7.5 | 2022-01-24 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-36342 | High | 7.5 | 2022-01-24 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-21933 | Medium | 6.7 | 2022-01-21 | ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) t… |
CVE-2022-22820 | Medium | 5.5 | 2022-01-20 | Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending speci… |
CVE-2022-22179 | Medium | 6.5 | 2022-01-19 | A Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an… |
CVE-2022-22176 | High | 7.4 | 2022-01-19 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unau… |
CVE-2022-22163 | High | 7.4 | 2022-01-19 | An Improper Input Validation vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to caus… |
CVE-2022-21696 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2021-42555 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-35969 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-33499 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2). |
CVE-2021-33498 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2). |
CVE-2021-32545 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation. |
CVE-2021-44530 | Critical | 9.8 | 2022-01-14 | An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to… |
CVE-2022-20698 | High | 7.5 | 2022-01-14 | A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unaut… |
CVE-2021-34994 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-43762 | Medium | 6.5 | 2022-01-13 | AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security… |
CVE-2021-30285 | Critical | 9.3 | 2022-01-13 | Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr… |
CVE-2022-21646 | High | 8.1 | 2022-01-11 | SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch… |
CVE-2021-41769 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All v… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-21408 | High | 8.8 | 2022-01-10 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, templat… |
CVE-2022-22287 | Low | 3.9 | 2022-01-10 | Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox. |
CVE-2022-22264 | High | 7.7 | 2022-01-10 | Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary files without permissi… |
CVE-2021-38957 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Forc… |
CVE-2021-35247 | Medium | 4.3 | 2022-01-10 | Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perf… |
CVE-2020-5956 | High | 7.5 | 2022-01-05 | An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11… |
CVE-2021-43779 | Critical | 9.9 | 2022-01-05 | GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenti… |
CVE-2021-45116 | High | 7.5 | 2022-01-05 | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolut… |
CVE-2021-43850 | Medium | 6.8 | 2022-01-04 | Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_… |
CVE-2022-20020 | Medium | 5.5 | 2022-01-04 | In libvcodecdrv, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional e… |
CVE-2022-20019 | Medium | 5.5 | 2022-01-04 | In libMtkOmxGsmDec, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additi… |
CVE-2021-41789 | Medium | 6.5 | 2022-01-04 | In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of service from a proximal attacker with n… |
CVE-2021-37116 | Critical | 9.1 | 2022-01-03 | PCManager has a Weaknesses Introduced During Design vulnerability .Successful exploitation of this vulnerability may cause that the PIN of the subscriber is ch… |
CVE-2021-24893 | High | 7.5 | 2022-01-03 | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the… |
CVE-2021-45916 | Low | 3.5 | 2022-01-03 | The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send m… |
CVE-2021-30278 | High | 7.1 | 2022-01-03 | Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2021-43861 | High | 7.2 | 2021-12-30 | Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams… |
CVE-2021-44832 | Medium | 6.6 | 2021-12-28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when… |
CVE-2021-43548 | Medium | 6.5 | 2021-12-27 | Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the pro… |
CVE-2021-45711 | High | 7.5 | 2021-12-27 | An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second cha… |
CVE-2021-45687 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation… |
CVE-2021-41788 | Medium | 6.5 | 2021-12-26 | MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and other devices, mishandle attempts at Wi-Fi authentication flooding. (Affected Chipsets M… |
CVE-2021-44548 | Critical | 9.8 | 2021-12-23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network cal… |
CVE-2021-4059 | Medium | 6.5 | 2021-12-23 | Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-38015 | High | 8.8 | 2021-12-23 | Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypas… |
CVE-2021-44422 | High | 7.8 | 2021-12-21 | An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file ca… |
CVE-2021-41561 | High | 7.5 | 2021-12-20 | Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet… |
CVE-2021-45105 | Medium | 5.9 | 2021-12-18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This a… |
CVE-2021-37863 | Low | 3.5 | 2021-12-17 | Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of… |
CVE-2021-1021 | High | 7.3 | 2021-12-15 | In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input valida… |
CVE-2021-1020 | High | 7.3 | 2021-12-15 | In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validati… |
CVE-2021-0933 | High | 8.0 | 2021-12-15 | In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to impr… |
CVE-2021-0928 | High | 7.8 | 2021-12-15 | In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could… |
CVE-2021-0921 | High | 7.8 | 2021-12-15 | In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This coul… |
CVE-2021-4117 | Medium | 4.3 | 2021-12-15 | yetiforcecrm is vulnerable to Business Logic Errors |
CVE-2021-20330 | Medium | 6.5 | 2021-12-15 | An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potentia… |
CVE-2021-4111 | Medium | 4.3 | 2021-12-15 | yetiforcecrm is vulnerable to Business Logic Errors |
CVE-2021-41844 | Critical | 9.8 | 2021-12-15 | Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. |
CVE-2021-42070 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application… |
CVE-2021-42068 | Low | 3.3 | 2021-12-14 | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and b… |
CVE-2021-38182 | High | 8.8 | 2021-12-14 | Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the… |
CVE-2021-39932 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-44228 | Critical | 10.0 | 2021-12-10 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter… |
CVE-2021-43803 | High | 7.5 | 2021-12-10 | Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected… |
CVE-2021-43802 | Critical | 9.9 | 2021-12-09 | Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the atta… |
CVE-2021-23862 | High | 7.2 | 2021-12-08 | A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affect… |
CVE-2021-37039 | Medium | 6.5 | 2021-12-08 | There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Bluetooth DoS. |
CVE-2021-25520 | Medium | 5.9 | 2021-12-08 | Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to e… |
CVE-2021-25517 | High | 7.7 | 2021-12-08 | An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrary code execution. |
CVE-2021-25512 | Medium | 6.1 | 2021-12-08 | An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain activities. |
CVE-2021-25511 | Medium | 6.3 | 2021-12-08 | An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerabi… |
CVE-2021-25510 | Medium | 5.3 | 2021-12-08 | An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code execution. |
CVE-2021-37096 | High | 7.5 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to user privacy disclosed. |
CVE-2021-37094 | High | 7.5 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system denial of service. |
CVE-2021-37084 | Critical | 9.8 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious invoking other func… |
CVE-2021-37081 | High | 7.5 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to nearby crash. |
CVE-2021-37060 | High | 7.5 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to SAMGR Heap Address Leakage. |
CVE-2021-37048 | High | 7.5 | 2021-12-07 | There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,p… |
CVE-2021-37047 | High | 7.5 | 2021-12-07 | There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause some services to restart. |
CVE-2021-20611 | High | 7.5 | 2021-12-01 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series… |