Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12661 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-21656 1 Qualcomm 256 Ar8035, Ar8035 Firmware, Csra6620 and 253 more 2024-11-21 7.8 High
Memory corruption in WLAN HOST while receiving an WMI event from firmware.
CVE-2023-21647 1 Qualcomm 86 Qca6390, Qca6390 Firmware, Qca6391 and 83 more 2024-11-21 6.5 Medium
Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
CVE-2023-21627 1 Qualcomm 96 Aqt1000, Aqt1000 Firmware, Qca6390 and 93 more 2024-11-21 6.7 Medium
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
CVE-2023-21621 2 Adobe, Microsoft 2 Framemaker, Windows 2024-11-21 7.8 High
FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-21574 3 Adobe, Apple, Microsoft 3 Photoshop, Macos, Windows 2024-11-21 7.8 High
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-21391 1 Google 1 Android 2024-11-21 7.5 High
In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-21284 1 Google 1 Android 2024-11-21 5.5 Medium
In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-21272 1 Google 1 Android 2024-11-21 7.8 High
In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-21251 1 Google 1 Android 2024-11-21 7.3 High
In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
CVE-2023-20564 2 Amd, Microsoft 5 Ryzen, Ryzen Master, Ryzen Master Monitoring Sdk and 2 more 2024-11-21 6.7 Medium
Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution.
CVE-2023-20560 2 Amd, Microsoft 4 Ryzen Master, Ryzen Master Monitoring Sdk, Windows 10 and 1 more 2024-11-21 4.4 Medium
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service.
CVE-2023-20270 1 Cisco 1 Firepower Threat Defense 2024-11-21 5.8 Medium
A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error-checking when the Snort 3 detection engine is processing SMB traffic. An attacker could exploit this vulnerability by sending a crafted SMB packet stream through an affected device. A successful exploit could allow the attacker to cause the Snort process to reload, resulting in a DoS condition.
CVE-2023-20255 1 Cisco 1 Meeting Server 2024-11-21 5.3 Medium
A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause a partial availability condition, which could cause ongoing video calls to be dropped due to the invalid packets reaching the Web Bridge.
CVE-2023-20232 1 Cisco 1 Unified Contact Center Express 2024-11-21 5.3 Medium
A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific API endpoint on the Unified CCX Finesse Portal. A successful exploit could allow the attacker to cause the internal WebProxy to redirect users to an attacker-controlled host.
CVE-2023-20231 1 Cisco 75 Catalyst 9105ax, Catalyst 9105axi, Catalyst 9105axw and 72 more 2024-11-21 8.8 High
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with level 15 privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a Lobby Ambassador account. This account is not configured by default.
CVE-2023-20192 1 Cisco 1 Telepresence Video Communication Server 2024-11-21 9.6 Critical
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20172 1 Cisco 1 Identity Services Engine 2024-11-21 5.4 Medium
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20171 1 Cisco 1 Identity Services Engine 2024-11-21 5.4 Medium
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20169 1 Cisco 35 Nexus 3048, Nexus 31108pc-v, Nexus 31108tc-v and 32 more 2024-11-21 7.4 High
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to unexpectedly restart, which could cause an affected device to reload. This vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet. An attacker could exploit this vulnerability by sending a crafted IS-IS packet to an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the unexpected restart of the IS-IS process, which could cause the affected device to reload. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2 adjacent to the affected device.
CVE-2023-20168 1 Cisco 84 Mds 9000, Mds 9100, Mds 9132t and 81 more 2024-11-21 7.1 High
A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenticated, local attacker to cause an affected device to unexpectedly reload. This vulnerability is due to incorrect input validation when processing an authentication attempt if the directed request option is enabled for TACACS+ or RADIUS. An attacker could exploit this vulnerability by entering a crafted string at the login prompt of an affected device. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a denial of service (DoS) condition.