Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12616 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-40746 1 Siemens 1 Simatic Rtls Locating Manager 2025-08-20 9.1 Critical
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute arbitrary code with 'NT Authority/SYSTEM' privileges.
CVE-2025-21477 1 Qualcomm 179 315 5g Iot Modem, 315 5g Iot Modem Firmware, Ar8035 and 176 more 2025-08-20 7.5 High
Transient DOS while processing CCCH data when NW sends data with invalid length.
CVE-2024-55567 1 Insyde 1 Insydeh2o 2025-08-20 7.5 High
Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CVE-2024-27241 1 Zoom 5 Meeting Software Development Kit, Rooms, Workplace and 2 more 2025-08-20 5.3 Medium
Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
CVE-2025-5497 1 Phpwcms 1 Phpwcms 2025-08-20 6.3 Medium
A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.
CVE-2023-52927 1 Linux 1 Linux Kernel 2025-08-19 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
CVE-2024-45422 1 Zoom 8 Meeting Sdk, Meeting Software Development Kit, Rooms and 5 more 2025-08-19 6.5 Medium
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
CVE-2025-6625 1 Schneider-electric 12 Bmxngd0100, Bmxngd0100 Firmware, Bmxnoc0401 and 9 more 2025-08-19 7.5 High
CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.
CVE-2025-9060 1 Msoft 1 Mflash 2025-08-18 9.1 Critical
A vulnerability has been found in the  MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of parameters when setting up security components. This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and above.
CVE-2025-52620 1 Hcltech 1 Bigfix Saas 2025-08-18 4.3 Medium
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format.
CVE-2023-43037 1 Ibm 1 Maximo Application Suite 2025-08-17 6.5 Medium
IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.
CVE-2025-27388 1 Oppo 1 Health App 2025-08-17 N/A
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
CVE-2025-8963 1 Jeecg 1 Jimureport 2025-08-17 6.3 Medium
A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".
CVE-2025-7507 1 Wordpress 1 Wordpress 2025-08-17 6.4 Medium
The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.
CVE-2024-20495 1 Cisco 3 Adaptive Security Appliance Software, Firepower Threat Defense, Firepower Threat Defense Software 2025-08-15 8.6 High
A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of client key data after the TLS session is established. An attacker could exploit this vulnerability by sending a crafted key value to an affected system over the secure TLS session. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVE-2025-3885 1 Samsung 2 Harman Mgu21, Harman Mgu21 Firmware 2025-08-15 6.5 Medium
Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Harman Becker MGU21 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Bluetooth stack of the BCM89359 chipset. The issue results from the lack of proper validation of Bluetooth frames. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23942.
CVE-2025-49554 1 Adobe 3 Commerce, Commerce B2b, Magento 2025-08-15 7.5 High
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
CVE-2025-8876 1 N-able 1 N-central 2025-08-15 8.8 High
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
CVE-2025-7971 1 Rockwellautomation 1 Studio 5000 Logix Designer 2025-08-15 N/A
A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash.
CVE-2021-27923 3 Fedoraproject, Python, Redhat 4 Fedora, Pillow, Enterprise Linux and 1 more 2025-08-15 7.5 High
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.