cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 118

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 6.5CVE-2020-28163EPSS 0.8%

    libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.

  2. 9.8CVE-2023-26463EPSS 2.3%

    strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired po…

  3. 7.5CVE-2023-29193EPSS 0.8%

    SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the…

  4. 2.7CVE-2023-29194EPSS 0.8%

    Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdm…

  5. 5.5CVE-2023-29569EPSS 0.3%

    Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).

  6. 7.5CVE-2023-27772EPSS 0.9%

    libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.

  7. 7.5CVE-2022-33294EPSS 0.4%

    Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message.

  8. 7.5CVE-2022-33223EPSS 0.4%

    Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding.

  9. 7.5CVE-2022-25739EPSS 0.4%

    Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

  10. 6.5CVE-2023-1994EPSS 1.0%

    GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

  11. 6.5CVE-2023-0004EPSS 1.1%

    A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that …

  12. 7.5CVE-2023-26917EPSS 0.9%

    libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

  13. 5.5CVE-2022-47468EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  14. 5.5CVE-2022-47467EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  15. 5.5CVE-2022-47466EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  16. 5.5CVE-2022-47465EPSS 0.08%

    In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.

  17. 7.5CVE-2023-28766EPSS 0.9%

    A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD89 (CP300) (All versions >= V7.80 < V9.64), SIPROTEC 5 6MU85 (CP300) (…

  18. 6.5CVE-2023-30456EPSS 0.5%

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.

  19. 6.8CVE-2023-28842EPSS 1.4%

    Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as mo…

  20. 6.8CVE-2023-28841EPSS 0.7%

    Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as mob…

  21. 8.7CVE-2023-28840EPSS 2.6%

    Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as mob…

  22. 7.5CVE-2020-23259EPSS 0.8%

    An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the Jsi_Strlen function in the src/jsiChar.c file.

  23. 5.3CVE-2023-26916EPSS 1.0%

    libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.

  24. 4.3CVE-2022-4770EPSS 0.4%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).

  25. 4.3CVE-2022-4769EPSS 0.4%

    Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.

  26. 7.5CVE-2023-28625EPSS 1.3%

    mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted …

  27. 6.5CVE-2023-0197EPSS 0.2%

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may lead to denial of service.

  28. 7.1CVE-2023-0181EPSS 0.2%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and data tampering.

  29. 5.3CVE-2022-3192EPSS 0.6%

    Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6.

  30. 7.8CVE-2022-4744EPSS 0.5%

    A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or pote…

  31. 5.5CVE-2022-44369EPSS 0.3%

    NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.

  32. 5.5CVE-2022-44368EPSS 0.3%

    NASM v2.16 was discovered to contain a null pointer deference in the NASM component

  33. 9.8CVE-2023-28631EPSS 1.3%

    comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTM…

  34. 7.8CVE-2023-24308EPSS 0.2%

    A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs …

  35. 9.8CVE-2022-23121EPSS 8.5%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue…

  36. 7.5CVE-2022-3116EPSS 0.9%

    The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on the vulnerable code path can cause the application to crash.

  37. 5.5CVE-2023-1631EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418. This affects the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to null pointer derefe…

  38. 5.5CVE-2023-1628EPSS 0.3%

    A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418. Affected is an unknown function in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to null pointer derefere…

  39. 7.5CVE-2023-25676EPSS 0.4%

    TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greate…

  40. 7.5CVE-2023-25674EPSS 0.4%

    TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.

  41. 7.5CVE-2023-25672EPSS 0.4%

    TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

  42. 7.5CVE-2023-25670EPSS 0.4%

    TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.…

  43. 7.5CVE-2023-25665EPSS 0.4%

    TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow versio…

  44. 7.5CVE-2023-25663EPSS 0.4%

    TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 …

  45. 7.5CVE-2023-25660EPSS 0.4%

    TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a …

  46. 5.5CVE-2023-1583EPSS 0.2%

    A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is no…

  47. 5.5CVE-2023-21036EPSS 0.5%

    In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A

  48. 5.5CVE-2023-21026EPSS 0.09%

    In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the code. This could lead to local denial of service with no additional execution p…

  49. 7.8CVE-2023-20993EPSS 0.10%

    In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …

  50. 6.5CVE-2023-28117EPSS 0.6%

    Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies valu…