Filtered by CWE-20
Total 12434 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-21316 1 Microsoft 10 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 7 more 2025-06-03 6.1 Medium
Windows Server Key Distribution Service Security Feature Bypass
CVE-2024-21319 2 Microsoft, Redhat 5 .net, Identity Model, Visual Studio 2022 and 2 more 2025-06-03 6.8 Medium
Microsoft Identity Denial of service vulnerability
CVE-2023-41781 1 Zte 2 Mf258, Mf258 Firmware 2025-06-03 5.7 Medium
There is a Cross-site scripting (XSS)  vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.
CVE-2024-20721 2 Adobe, Microsoft 2 Acrobat, Edge Chromium 2025-06-03 5.5 Medium
Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-2264 1 Selinc 2 Sel-411l, Sel-411l Firmware 2025-06-03 4 Medium
An improper input validation vulnerability in the Schweitzer Engineering Laboratories SEL-411L could allow a malicious actor to manipulate authorized users to click on a link that could allow undesired behavior. See product Instruction Manual Appendix A dated 20230830 for more details.
CVE-2023-40699 3 Ibm, Linux, Microsoft 4 Aix, Infosphere Information Server, Linux Kernel and 1 more 2025-06-03 7.5 High
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.
CVE-2025-5455 1 Redhat 1 Enterprise Linux 2025-06-02 5.3 Medium
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
CVE-2024-6239 2 Freedesktop, Redhat 2 Poppler, Enterprise Linux 2025-06-01 7.5 High
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
CVE-2025-46836 2025-05-31 6.6 Medium
net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.
CVE-2023-28484 3 Debian, Redhat, Xmlsoft 5 Debian Linux, Enterprise Linux, Jboss Core Services and 2 more 2025-05-30 6.5 Medium
In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.
CVE-2024-34009 1 Moodle 1 Moodle 2025-05-30 7.5 High
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
CVE-2024-33999 1 Moodle 1 Moodle 2025-05-30 9.8 Critical
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVE-2024-33996 1 Moodle 1 Moodle 2025-05-30 6.2 Medium
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
CVE-2025-5326 2025-05-30 6.3 Medium
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-48490 2025-05-30 N/A
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.
CVE-2025-4635 2025-05-30 6.6 Medium
A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the local device as a low privileged user.
CVE-2024-51392 2025-05-30 8.8 High
An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
CVE-2023-47158 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, Db2 and 4 more 2025-05-30 5.3 Medium
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750.
CVE-2024-22768 1 Hitron Systems 2 Dvr Hvr-4781, Dvr Hvr-4781 Firmware 2025-05-30 7.4 High
Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22769 1 Hitron Systems 2 Dvr Hvr-4781, Dvr Hvr-4781 Firmware 2025-05-30 7.4 High
Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.