CWE-129: Improper Validation of Array Index, page 9
Filter
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
What the weakness is: CWE-129 at MITRE
Ask an AI about CWE-129
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-129: Improper Validation of Array Index and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/129.html and https://cve.bz/cve/cwe/129?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2023-21636EPSS 0.1%
Memory Corruption due to improper validation of array index in Linux while updating adn record.
- 7.8CVE-2022-40534EPSS 0.1%
Memory corruption due to improper validation of array index in Audio.
- 7.8CVE-2022-33275EPSS 0.1%
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
- 5.5CVE-2023-36307EPSS 0.3%
ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have…
- 5.5CVE-2023-36308EPSS 0.4%
disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use …
- 8.8CVE-2022-48503KEVEPSS 3.2%
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
- 7.8CVE-2023-21650EPSS 0.1%
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
- 7.5CVE-2023-29458EPSS 0.8%
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solut…
- 7.8CVE-2023-31194EPSS 0.4%
An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead to memory corruption. A victim would need to open a malicious file to trigger th…
- 7.8CVE-2023-2570EPSS 0.2%
A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an unpredictable inde…
- 7.8CVE-2023-0950EPSS 0.3%
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected v…
- 7.8CVE-2022-33281EPSS 0.1%
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
- 9.8CVE-2023-28004EPSS 1.1%
A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of service or remote code execution.
- 8.2CVE-2023-2008EPSS 1.0%
A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow …
- 7.8CVE-2022-33302EPSS 0.1%
Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
- 6.8CVE-2022-33289EPSS 0.2%
Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
- 9.8CVE-2023-26066EPSS 0.7%
Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.
- 8.8CVE-2022-38072EPSS 1.1%
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a …
- 7.5CVE-2023-20080EPSS 1.0%
A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to ins…
- 7.8CVE-2022-40539EPSS 0.1%
Memory corruption in Automotive Android OS due to improper validation of array index.
- 9.8CVE-2022-40537EPSS 0.4%
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
- 9.8CVE-2022-33256EPSS 0.5%
Memory corruption due to improper validation of array index in Multi-mode call processor.
- 6.7CVE-2023-20633EPSS 0.09%
In usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0762850…
- 9.8CVE-2023-0755EPSS 12%
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 5.5CVE-2022-47348EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47347EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47346EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47345EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47344EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47343EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 5.5CVE-2022-47342EPSS 0.09%
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
- 7.5CVE-2023-22408EPSS 0.6%
An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets w…
- 7.5CVE-2023-22401EPSS 0.6%
An Improper Validation of Array Index vulnerability in the Advanced Forwarding Toolkit Manager daemon (aftmand) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Servic…
- 7.8CVE-2022-33274EPSS 0.1%
Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.
- 7.8CVE-2022-42255EPSS 0.3%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
- 7.8CVE-2022-42254EPSS 0.3%
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, data tampering, or information disclosure.
- 4.3CVE-2022-31745EPSS 0.4%
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101.
- 7.8CVE-2022-2951EPSS 0.3%
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processing of H3D files. A DWORD value from a PoC file is extracted and used as an index to write to a buffer,…
- 7.8CVE-2022-25711EPSS 0.1%
Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- 7.8CVE-2022-25695EPSS 0.1%
Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon I…
- 8.8CVE-2022-46152EPSS 0.5%
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by b…
- 9.8CVE-2022-25720EPSS 0.5%
Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
- 6.5CVE-2022-42011EPSS 1.8%
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an arra…
- 7.5CVE-2022-25690EPSS 0.4%
Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Con…
- 7.8CVE-2022-22099EPSS 0.1%
Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto
- 7.5CVE-2022-35737EPSS 24%
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
- 7.5CVE-2022-31135EPSS 0.9%
Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to a denial of service attack. An attacker can use a specially crafted evidence pa…
- 6.7CVE-2022-31603EPSS 0.2%
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denia…
- 7.8CVE-2021-35126EPSS 0.2%
Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- 6.7CVE-2021-35121EPSS 0.2%
An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile