Filtered by CWE-20
Total 12428 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-46836 2025-05-31 6.6 Medium
net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.
CVE-2023-28484 3 Debian, Redhat, Xmlsoft 5 Debian Linux, Enterprise Linux, Jboss Core Services and 2 more 2025-05-30 6.5 Medium
In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.
CVE-2024-34009 1 Moodle 1 Moodle 2025-05-30 7.5 High
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
CVE-2024-33999 1 Moodle 1 Moodle 2025-05-30 9.8 Critical
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVE-2024-33996 1 Moodle 1 Moodle 2025-05-30 6.2 Medium
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
CVE-2025-5326 2025-05-30 6.3 Medium
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-48490 2025-05-30 N/A
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.
CVE-2025-4635 2025-05-30 6.6 Medium
A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the local device as a low privileged user.
CVE-2024-51392 2025-05-30 8.8 High
An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
CVE-2023-47158 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, Db2 and 4 more 2025-05-30 5.3 Medium
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750.
CVE-2024-22768 1 Hitron Systems 2 Dvr Hvr-4781, Dvr Hvr-4781 Firmware 2025-05-30 7.4 High
Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22769 1 Hitron Systems 2 Dvr Hvr-4781, Dvr Hvr-4781 Firmware 2025-05-30 7.4 High
Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-40458 1 Ocuco 1 Innovation 2025-05-30 7.8 High
An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
CVE-2022-35773 1 Microsoft 1 Azure Real Time Operating System Guix Studio 2025-05-29 7.8 High
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2022-23766 2 Bigfile, Microsoft 2 Bigfileagent, Windows 2025-05-29 7.8 High
An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website.
CVE-2024-21413 1 Microsoft 3 365 Apps, Office, Office Long Term Servicing Channel 2025-05-29 9.8 Critical
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21388 1 Microsoft 1 Edge Chromium 2025-05-29 6.5 Medium
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2025-27151 2025-05-29 4.7 Medium
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
CVE-2025-33043 2025-05-29 5.8 Medium
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.
CVE-2025-5148 2025-05-28 5.3 Medium
A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.