CWE-252 (page 2)
Page 2 of 2 — CVEs classified under CWE-252, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40279 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a miss… |
CVE-2022-40716 | Medium | 6.5 | 2022-09-23 | HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enablin… |
CVE-2022-38936 | High | 7.5 | 2022-09-23 | An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137. |
CVE-2022-31225 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-31220 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-1319 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though… |
CVE-2022-0485 | Medium | 4.8 | 2022-08-29 | A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the… |
CVE-2021-4189 | Medium | 5.3 | 2022-08-24 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the… |
CVE-2021-3998 | High | 7.5 | 2022-08-24 | A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sens… |
CVE-2021-3659 | Medium | 5.5 | 2022-08-22 | A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection… |
CVE-2022-31170 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `… |
CVE-2022-31089 | High | 7.5 | 2022-06-27 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files req… |
CVE-2022-21211 | Medium | 5.9 | 2022-06-10 | This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a… |
CVE-2022-30783 | Medium | 6.7 | 2022-05-26 | An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 whe… |
CVE-2021-0155 | Medium | 5.5 | 2022-05-12 | Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local acc… |
CVE-2021-41041 | Medium | 5.3 | 2022-04-27 | In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a Meth… |
CVE-2021-42780 | Medium | 5.3 | 2022-04-18 | A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library. |
CVE-2022-0907 | Medium | 5.5 | 2022-03-11 | Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2022-23806 | Critical | 9.1 | 2022-02-11 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a v… |
CVE-2021-0107 | Medium | 6.7 | 2022-02-09 | Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-23626 | High | 8.5 | 2022-02-08 | m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Althoug… |
CVE-2021-40401 | High | 8.6 | 2022-02-04 | A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2… |
CVE-2021-34405 | Medium | 5.5 | 2022-01-18 | NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointer dereference may l… |
CVE-2021-39643 | Medium | 6.7 | 2021-12-15 | In ic_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of the return value. This… |
CVE-2021-3911 | Medium | 4.2 | 2021-11-11 | If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. |
CVE-2021-34585 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all condit… |
CVE-2021-31366 | Medium | 6.5 | 2021-10-19 | An Unchecked Return Value vulnerability in the authd (authentication daemon) of Juniper Networks Junos OS on MX Series configured for subscriber management / B… |
CVE-2021-29853 | Medium | 4.3 | 2021-09-01 | IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions… |
CVE-2021-38171 | Critical | 9.8 | 2021-08-21 | adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argume… |
CVE-2021-29739 | Medium | 4.9 | 2021-08-10 | IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 19884… |
CVE-2021-37625 | High | 7.5 | 2021-08-05 | Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socke… |
CVE-2021-38114 | Medium | 5.5 | 2021-08-04 | libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. |
CVE-2021-3673 | High | 7.5 | 2021-08-02 | A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS. |
CVE-2021-28675 | Medium | 5.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the dat… |
CVE-2021-28906 | High | 7.5 | 2021-05-20 | In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to… |
CVE-2021-28904 | High | 7.5 | 2021-05-20 | In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revis… |
CVE-2021-28902 | High | 7.5 | 2021-05-20 | In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which lea… |
CVE-2021-21219 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21217 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-28875 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer… |
CVE-2020-12372 | Medium | 5.5 | 2021-02-17 | Unchecked return value in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service vi… |
CVE-2021-26958 | High | 8.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb… |
CVE-2021-26955 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str… |
CVE-2019-15523 | Medium | 5.3 | 2020-12-30 | An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake(… |
CVE-2020-17533 | High | 8.1 | 2020-12-29 | Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting a… |
CVE-2020-5359 | Medium | 5.8 | 2020-12-16 | Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could pote… |
CVE-2020-27898 | Medium | 5.5 | 2020-12-08 | A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1. An attacker may be able to bypass Managed Fr… |
CVE-1999-0199 | Critical | 9.8 | 2020-10-06 | manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, whi… |
CVE-2020-15191 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind… |
CVE-2020-4531 | Medium | 5.3 | 2020-09-25 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive info… |
CVE-2020-6152 | High | 7.8 | 2020-09-01 | A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause… |
CVE-2020-6078 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_r… |
CVE-2019-15900 | Critical | 9.8 | 2019-10-18 | An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking… |
CVE-2019-17178 | High | 7.5 | 2019-10-04 | HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplie… |
CVE-2019-9372 | Medium | 6.5 | 2019-09-27 | In libskia, there is a possible crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed… |
CVE-2019-15942 | High | 8.8 | 2019-09-05 | FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c m… |
CVE-2019-12107 | High | 7.5 | 2019-05-15 | The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper va… |
CVE-2019-10902 | High | 7.5 | 2019-04-09 | In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely. |
CVE-2019-9704 | Medium | 5.5 | 2019-03-12 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc retu… |
CVE-2018-20216 | High | 7.5 | 2018-12-20 | QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). |
CVE-2018-16643 | Medium | 6.5 | 2018-09-06 | The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0… |
CVE-2018-14622 | High | 7.5 | 2018-08-30 | A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, wh… |
CVE-2018-14367 | High | 7.5 | 2018-07-19 | In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checki… |
CVE-2017-0774 | Medium | 5.5 | 2017-09-08 | A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1… |
CVE-2017-0720 | High | 7.8 | 2017-08-09 | A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Androi… |
CVE-2017-0599 | Medium | 5.5 | 2017-05-12 | A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. T… |
CVE-2017-6964 | High | 7.8 | 2017-03-28 | dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might… |
CVE-2016-10061 | Medium | 6.5 | 2017-03-03 | The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attacke… |
CVE-2016-10060 | Medium | 6.5 | 2017-03-02 | The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows re… |
CVE-2010-0211 | Critical | 9.8 | 2010-07-28 | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attac… |
CVE-2009-0265 | High | 7.5 | 2009-01-26 | Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remot… |
CVE-2007-5191 | | 2007-10-04 | mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow… | |
CVE-2007-3798 | Critical | 9.8 | 2007-07-16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP p… |
CVE-2005-4360 | | 2005-12-20 | The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multip… | |
CVE-2002-1372 | High | 7.5 | 2002-12-26 | Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a r… |