cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 120

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 5.5CVE-2023-22997EPSS 0.3%

    In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

  2. 7.5CVE-2023-23109EPSS 0.7%

    In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv.

  3. 7.5CVE-2023-23108EPSS 0.9%

    In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc.

  4. 6.5CVE-2021-3329EPSS 0.6%

    Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack

  5. 7.5CVE-2023-25956EPSS 1.5%

    Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.

  6. 9.8CVE-2021-4105EPSS 0.9%

    Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.

  7. 9.8CVE-2022-48329EPSS 0.9%

    MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

  8. 9.8CVE-2022-48328EPSS 1.3%

    app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

  9. 7.8CVE-2021-32846EPSS 0.3%

    HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the retu…

  10. 7.8CVE-2021-32845EPSS 0.2%

    HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads…

  11. 5.5CVE-2021-32844EPSS 0.2%

    HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash…

  12. 5.5CVE-2021-32843EPSS 0.2%

    HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This…

  13. 5.5CVE-2023-21593EPSS 0.3%

    Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in th…

  14. 4.3CVE-2022-36287EPSS 0.2%

    Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable denial of service via physical access.

  15. 5.5CVE-2022-35883EPSS 0.2%

    NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.

  16. 7.5CVE-2022-30692EPSS 0.6%

    Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable denial of service via network access.

  17. 5.5CVE-2022-29523EPSS 0.2%

    Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentially enable denial of service via local access.

  18. 4.9CVE-2022-29493EPSS 0.5%

    Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privileged user to potentially enable denial of service via network access.

  19. 4.4CVE-2022-36794EPSS 0.2%

    Improper condition check in some Intel(R) SPS firmware before version SPS_E3_06.00.03.300.0 may allow a privileged user to potentially enable denial of service via local access.

  20. 4.4CVE-2022-34849EPSS 0.2%

    Uncaught exception in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1436(v2) may allow a privileged user to potentially enable denial of service via local access.

  21. 5.5CVE-2022-26509EPSS 0.2%

    Improper conditions check in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.

  22. 7.5CVE-2023-21700EPSS 1.7%

    Windows iSCSI Discovery Service Denial of Service Vulnerability

  23. 5.3CVE-2023-22943EPSS 0.3%

    In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connec…

  24. 7.5CVE-2023-22941EPSS 1.0%

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

  25. 5.3CVE-2023-0655EPSS 0.7%

    SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.

  26. 8.8CVE-2023-0790EPSS 0.7%

    Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

  27. 5.5CVE-2022-47360EPSS 0.09%

    In log service, there is a missing permission check. This could lead to local denial of service in log service.

  28. 5.5CVE-2022-47359EPSS 0.09%

    In log service, there is a missing permission check. This could lead to local denial of service in log service.

  29. 5.5CVE-2022-44447EPSS 0.09%

    In wlan driver, there is a possible null pointer dereference issue due to a missing bounds check. This could lead to local denial of service in wlan services.

  30. 7.5CVE-2022-25735EPSS 0.4%

    Denial of service in modem due to missing null check while processing TCP or UDP packets from server

  31. 7.5CVE-2022-25733EPSS 0.4%

    Denial of service in modem due to null pointer dereference while processing DNS packets

  32. 9.8CVE-2023-25561EPSS 0.4%

    DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the sy…

  33. 5.3CVE-2022-46675EPSS 0.5%

    Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for…

  34. 7.5CVE-2023-23626EPSS 0.9%

    go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trig…

  35. 7.8CVE-2023-21421EPSS 0.2%

    Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN.

  36. 7.5CVE-2023-0401EPSS 1.8%

    A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorith…

  37. 7.5CVE-2023-0217EPSS 1.8%

    An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called …

  38. 7.5CVE-2023-0216EPSS 1.8%

    An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which …

  39. 7.5CVE-2022-43765EPSS 0.6%

    B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.

  40. 7.5CVE-2022-43763EPSS 0.6%

    Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.

  41. 6.5CVE-2023-23931EPSS 1.3%

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable b…

  42. 4.3CVE-2022-45854EPSS 0.3%

    An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vu…

  43. 5.5CVE-2023-0615EPSS 0.2%

    A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a…

  44. 7.5CVE-2022-32663EPSS 1.6%

    In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN202…

  45. 6.7CVE-2022-32655EPSS 0.3%

    In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: G…

  46. 7.5CVE-2023-23932EPSS 0.7%

    OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issu…

  47. 9.8CVE-2023-23087EPSS 0.9%

    An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.

  48. 7.5CVE-2023-22839EPSS 0.6%

    On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server…

  49. 7.5CVE-2023-22341EPSS 0.6%

    On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth S…

  50. 7.5CVE-2023-22340EPSS 0.6%

    On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause TMM to terminate.…