CVE-2022-25161

CVE-2022-25161 is an Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F Series controllers (FX5U FX5UCFX5S FX5UJ CPU modules, etc.). A remote, unauthenticated attacker can trigger a denial-of-service by sending specially crafted packets to affected Ethernet communications,...

CVE-2022-1727

CVE-2022-1727 affects the GitHub project jgraph/drawio prior to version 18.0.6. The root cause is improper input validation in the Electron desktop app’s link handling, allowing crafted links (e.g., via file: or other dangerous schemas) to be passed to shell.openExternal and potentially trigger c...

CVE-2022-28190

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape, where improper input validation can cause denial of service...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to improper handling of unspecified characters in variable names. An attacker can exploit this vulnerability to manipulate or contaminate HTTP parameters by sending crafted requests with malicious variable...

GHSA-R7PJ-RVWG-VXHR OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability

The Sheepdog backend in OpenStack Image Registry and Delivery Service Glance 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location...

OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability

The Sheepdog backend in OpenStack Image Registry and Delivery Service Glance 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location...

Improper Input Validation in Drools and jBPM

XML external entity XXE vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file...

GHSA-Q3CJ-2R34-2CWC Improper input validation in cryptography

HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digestsize...

GHSA-5JC8-8XHV-G8QM Improper Input Validation in XFire

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof...

Improper Input Validation in IpMatcher

An Input Validation Vulnerability exists in Joel Christner .NET C packages WatsonWebserver, IpMatcher 1.0.4.1 and below IpMatcher and 4.1.3 and below WatsonWebserver due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets...

FormEncode Access Restrictions Bypass

schema.py in FormEncode for Python python-formencode 1.0 does not apply the chainedvalidators feature, which allows attackers to bypass intended access restrictions via unknown vectors...

The vulnerability of Mozilla Thunderbird’s email client lies in the improper processing of user-input data when dealing with signed and encrypted embedded messages. This allows attackers to perform spamming attacks.

The vulnerability in Mozilla Thunderbird’s email client allows for incorrect processing of user-input data when dealing with signed and encrypted embedded messages. Exploiting this vulnerability can enable a malicious actor to carry out spam attacks by sending specially crafted email messages...

Improper Input Validation

The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1584CyVDB-2670 Operation restriction bypass vulnerability in Bulletin CWE-285 - CVE-2022-28718 CyVDB-1865CyVDB-2692 Operation restriction bypass vulnerability in Workflow CWE-285 - CVE-2022-27661...

JVN#73897863: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1584CyVDB-2670 Operation restriction bypass vulnerability in Bulletin CWE-285 - CVE-2022-28718 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N| Base Score: 4.3 CVS...

GHSA-CVVX-R33M-V7PQ Improper Input Validation in Apache Struts

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter...

GHSA-XG47-R67P-VHV5 Improper Input Validation in Deap

The utilities function in all versions 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects...

Elefant CMS Improper Input Validation

apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism...

GHSA-62G2-M955-V383 Improper Input Validation in Apache Spark

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...

GHSA-M6G3-XQ5Q-4HG9 Improper Input Validation in Apache Karaf

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...