Filtered by CWE-20
Filtered by vendor Subscriptions
Total 13193 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-33999 1 Moodle 1 Moodle 2025-05-30 9.8 Critical
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVE-2024-33996 1 Moodle 1 Moodle 2025-05-30 6.2 Medium
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
CVE-2023-47158 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, Db2 and 4 more 2025-05-30 5.3 Medium
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750.
CVE-2024-40458 1 Ocuco 1 Innovation 2025-05-30 7.8 High
An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
CVE-2022-35773 1 Microsoft 1 Azure Real Time Operating System Guix Studio 2025-05-29 7.8 High
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2022-23766 2 Bigfile, Microsoft 2 Bigfileagent, Windows 2025-05-29 7.8 High
An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website.
CVE-2024-21388 1 Microsoft 1 Edge Chromium 2025-05-29 6.5 Medium
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-37395 1 Huawei 2 Cv81-wdm Fw, Cv81-wdm Fw Firmware 2025-05-28 7.5 High
A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46.
CVE-2020-14797 5 Debian, Netapp, Opensuse and 2 more 22 Debian Linux, 7-mode Transition Tool, Active Iq Unified Manager and 19 more 2025-05-27 3.7 Low
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2020-14621 8 Canonical, Debian, Fedoraproject and 5 more 27 Ubuntu Linux, Debian Linux, Fedora and 24 more 2025-05-27 5.3 Medium
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2024-29461 2 Atlassian, Projectfloodlight 2 Floodlight Controller, Open Sdn Controller 2025-05-27 6.3 Medium
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component.
CVE-2023-48425 1 Google 2 Chromecast, Chromecast Firmware 2025-05-27 9.8 Critical
U-Boot vulnerability resulting in persistent Code Execution 
CVE-2021-27774 1 Hcltech 1 Hcl Digital Experience 2025-05-27 3.1 Low
User input included in error response, which could be used in a phishing attack.
CVE-2024-36907 2025-05-26 5.5 Medium
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2023-46285 1 Siemens 4 Opcenter Quality, Simatic Pcs Neo, Sinumerik Integrate Runmyhmi \/automotive and 1 more 2025-05-24 7.5 High
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerability that could allow an attacker to bring the service into a Denial-of-Service state by sending a specifically crafted message to 4004/tcp. The corresponding service is auto-restarted after the crash is detected by a watchdog.
CVE-2017-7957 3 Debian, Redhat, Xstream 8 Debian Linux, Fuse, Jboss Amq and 5 more 2025-05-23 7.5 High
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
CVE-2022-24280 1 Apache 1 Pulsar 2025-05-23 6.5 Medium
Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.
CVE-2022-32797 1 Apple 2 Mac Os X, Macos 2025-05-22 7.1 High
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.
CVE-2022-32786 1 Apple 2 Mac Os X, Macos 2025-05-22 5.5 Medium
An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to modify protected parts of the file system.
CVE-2022-22423 2 Ibm, Linux 5 Aix, Common Cryptographic Architecture, I and 2 more 2025-05-22 5.5 Medium
IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation. IBM X-Force ID: 223596.