Base de CVEs

CVE-2022-3169 Média · 5.5 CWE-20 09/09/2022

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a...

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.

CVE-2022-1271 Alta · 8.8 CWE-20 31/08/2022

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is...

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

CVE-2022-30168 Alta · 7.8 CWE-20 15/06/2022

Microsoft Photos App Remote Code Execution Vulnerability

CVE-2022-29499 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-20 25/04/2022

Mitel MiVoice Connect Data Validation Vulnerability

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CVE-2022-24086 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-20 16/02/2022

Adobe Commerce e Magento Open Source: validação inadequada de entrada no checkout

Adobe Commerce, versões 2.4.3-p1 (e anteriores) e 2.3.7-p2 (e anteriores), são afetados por uma vulnerabilidade de validação inadequada de entrada durante o processo de checkout. A exploração desta falha não requer interação do usuário e pode resultar em execução arbitrária de código.

CVE-2021-36343 Média · 6.4 CWE-20 24/01/2022

Improper Input Validation em Dell Precision 5820 Tower Firmware

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVE-2021-36342 Média · 6.4 CWE-20 24/01/2022

Improper Input Validation em Dell Precision 7510 Firmware

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVE-2021-35247 Média · 5.3 KEV Alta · 51 CWE-20 10/01/2022

SolarWinds Serv-U Improper Input Validation Vulnerability

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

CVE-2021-44228 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-20 10/12/2021

Execução remota de código no Apache Log4j2 via consultas JNDI

Apache Log4j2 2.0-beta9 até 2.15.0 (excluindo as versões de segurança 2.12.2, 2.12.3 e 2.3.1): os recursos JNDI usados em configuração, mensagens de log e parâmetros não protegem contra endpoints LDAP e outros endpoints relacionados a JNDI controlados por um atacante. Um atacante que consiga controlar mensagens de log ou parâmetros de mensagens de log pode executar código arbitrário carregado de servidores LDAP quando a substituição por consultas de mensagem está habilitada. A partir do log4j 2.15.0, esse comportamento foi desabilitado por padrão. A partir da versão 2.16.0 (junto com 2.12.2, 2.12.3 e 2.3.1), essa funcionalidade foi completamente removida. Observe que esta vulnerabilidade é específica do log4j-core e não afeta log4net, log4cxx ou outros projetos do Apache Logging Services.

CVE-2021-0158 Média · 6.7 CWE-20 17/11/2021

Improper Input Validation em Intel Celeron N2805

Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2021-36325 Média · 6.7 CWE-20 12/11/2021

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious...

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVE-2021-36324 Média · 6.7 CWE-20 12/11/2021

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious...

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVE-2021-36323 Média · 6.7 CWE-20 12/11/2021

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious...

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVE-2021-3572 Média · 5.7 CWE-20 10/11/2021

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

CVE-2021-3655 Baixa · 3.3 CWE-20 05/08/2021

Improper Input Validation em Linux Linux Kernel

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

CVE-2021-3580 Alta · 7.5 CWE-20 05/08/2021

A flaw was found in the way nettle's RSA decryption functions handled specially crafted...

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVE-2021-36742 Alta · 7.8 KEV Alta · 52 CWE-20 29/07/2021

Trend Micro Multiple Products Improper Input Validation Vulnerability

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2020-8700 Média · 6.7 CWE-20 09/06/2021

Improper input validation in the firmware for some Intel(R) Processors may allow a privileged...

Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2020-24486 Média · 5.5 CWE-20 09/06/2021

Improper Input Validation em Intel Bios

Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

CVE-2020-26144 Média · 6.5 CWE-20 11/05/2021

Improper Input Validation em Samsung Galaxy I9305 Firmware

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

CVE-2020-11987 Alta · 8.2 CWE-20 24/02/2021

Improper Input Validation em Apache Software Foundation Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVE-2020-35493 Média · 5.5 CWE-20 04/01/2021

Improper Input Validation em Gnu Binutils

A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.

CVE-2020-13956 Média · 5.3 CWE-20 02/12/2020

Improper Input Validation em Apache Software Foundation Httpclient

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVE-2020-12322 Média · 6.5 CWE-20 12/11/2020

Improper Input Validation em Intel Dual Band Wireless-ac 3168 Firmware

Improper input validation in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

CVE-2020-1350 Crítica · 10.0 KEV Alta · 69 Exploit público CWE-20 14/07/2020

Microsoft Windows DNS Server Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.