Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12486 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-32144 1 Huawei 2 Cv81-wdm, Cv81-wdm Firmware 2025-07-11 8.6 High
There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulnerability ID: HWPSIRT-2022-76192) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32144.
CVE-2025-53502 2025-07-11 6.5 Medium
Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
CVE-2024-45031 1 Apache 1 Syncope 2025-07-11 6.1 Medium
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking. Users are recommended to upgrade to version 3.0.9, which fixes this issue.
CVE-2024-3584 1 Qdrant 1 Qdrant 2025-07-10 7.5 High
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.
CVE-2024-3829 1 Qdrant 1 Qdrant 2025-07-10 9.1 Critical
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.
CVE-2024-4287 1 Mintplexlabs 1 Anythingllm 2025-07-10 7.2 High
In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts.
CVE-2023-29335 1 Microsoft 15 365 Apps, Office, Windows 10 1507 and 12 more 2025-07-10 7.5 High
Microsoft Word Security Feature Bypass Vulnerability
CVE-2023-24950 1 Microsoft 2 Sharepoint Enterprise Server, Sharepoint Server 2025-07-10 6.5 Medium
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2024-38189 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2025-07-10 8.8 High
Microsoft Project Remote Code Execution Vulnerability
CVE-2024-38201 1 Microsoft 1 Azure Stack Hub 2025-07-10 7 High
Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2024-38196 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 7.8 High
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-34365 1 Apache 1 Karaf Cave 2025-07-10 9.1 Critical
** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2024-4321 1 Gaizhenbiao 1 Chuanhuchatgpt 2025-07-10 N/A
A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker can exploit this vulnerability by intercepting requests and manipulating the 'name' parameter to specify arbitrary file paths. This allows the attacker to read sensitive files on the server, leading to information leakage, including API keys and private information. The issue affects version 20240310 of the application.
CVE-2025-26647 1 Microsoft 7 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 4 more 2025-07-10 8.8 High
Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-24058 1 Microsoft 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more 2025-07-10 7.8 High
Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2025-27737 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 8.6 High
Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.
CVE-2018-7726 3 Canonical, Gdraheim, Redhat 6 Ubuntu Linux, Zziplib, Enterprise Linux and 3 more 2025-07-10 N/A
An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVE-2018-6484 2 Canonical, Gdraheim 2 Ubuntu Linux, Zziplib 2025-07-10 N/A
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVE-2018-6541 3 Canonical, Gdraheim, Redhat 3 Ubuntu Linux, Zziplib, Enterprise Linux 2025-07-10 N/A
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVE-2025-29811 1 Microsoft 5 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 2 more 2025-07-10 7.8 High
Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.