Filtered by CWE-20
Filtered by vendor Subscriptions
Total 13158 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2011-4317 2 Apache, Redhat 2 Http Server, Enterprise Linux 2025-04-11 N/A
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVE-2010-3473 1 Ibm 1 Filenet P8 Application Engine 2025-04-11 N/A
Open redirect vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2022-42269 1 Nvidia 14 Jetson Agx Xavier, Jetson Agx Xavier 16gb, Jetson Agx Xavier 32gb and 11 more 2025-04-10 7.9 High
NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cause information disclosure and compromise integrity. The scope of the impact can extend to other components.
CVE-2022-34681 2 Microsoft, Nvidia 3 Windows, Cloud Gaming, Virtual Gpu 2025-04-10 5.5 Medium
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-related data structure may lead to denial of service.
CVE-2022-32653 2 Google, Mediatek 6 Android, Mt6789, Mt6855 and 3 more 2025-04-10 6.7 Medium
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262518; Issue ID: ALPS07262518.
CVE-2024-24695 1 Zoom 3 Meeting Software Development Kit, Vdi Windows Meeting Clients, Zoom 2025-04-10 6.8 Medium
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
CVE-2022-32652 2 Google, Mediatek 6 Android, Mt6833, Mt6853 and 3 more 2025-04-10 6.7 Medium
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262617; Issue ID: ALPS07262617.
CVE-2024-36047 1 Infoblox 1 Nios 2025-04-10 9.8 Critical
Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.
CVE-2023-40515 1 Lg 1 Simple Editor 2025-04-10 7.5 High
LG Simple Editor joinAddUser Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the joinAddUser method. The issue results from improper input validation. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-20048.
CVE-2021-26316 1 Amd 294 Athlon 3050ge, Athlon 3050ge Firmware, Athlon 3150g and 291 more 2025-04-09 7.8 High
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.
CVE-2023-0091 1 Redhat 4 Keycloak, Red Hat Single Sign On, Rhosemc and 1 more 2025-04-09 3.8 Low
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.
CVE-2022-33300 1 Qualcomm 102 Qam8295p, Qam8295p Firmware, Qca6174a and 99 more 2025-04-09 8.4 High
Memory corruption in Automotive Android OS due to improper input validation.
CVE-2022-23814 1 Amd 2 Milanpi-sp3, Milanpi-sp3 Firmware 2025-04-09 5.3 Medium
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute environment.
CVE-2021-46767 1 Amd 4 Milanpi, Milanpi Firmware, Romepi and 1 more 2025-04-09 6.1 Medium
Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrity or denial of service.
CVE-2022-4428 1 Cloudflare 1 Warp 2025-04-09 8.9 High
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).
CVE-2007-6527 1 Rickard Andersson 1 Punbb 2025-04-09 N/A
uploadimg.php in the Automatic Image Upload with Thumbnails (imgUpload) module 1.3.2 for PunBB only verifies the Content-type field of uploaded files, which allows remote attackers to upload and execute arbitrary content via a file with a (1) JPG, (2) GIF, or (3) PNG MIME type.
CVE-2008-3932 2 Redhat, Wireshark 2 Enterprise Linux, Wireshark 2025-04-09 N/A
Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NCP packet that triggers an infinite loop.
CVE-2008-3904 1 Lxde 2 Gpicview, Lightweight X11 Desktop Environment 2025-04-09 N/A
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
CVE-2007-5047 1 Symantec 1 Norton Internet Security 2025-04-09 N/A
Norton Internet Security 2008 15.0.0.60 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the NtOpenSection kernel SSDT hook. NOTE: the NtCreateMutant and NtOpenEvent function hooks are already covered by CVE-2007-1793.
CVE-2008-1693 2 Poppler, Redhat 2 Poppler, Enterprise Linux 2025-04-09 N/A
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.