CWE-20 · Improper Input Validation (page 47)
Page 47 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34311 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Mono_loader.dll library in affected a… |
CVE-2021-34310 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected a… |
CVE-2021-34309 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected a… |
CVE-2021-34305 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected ap… |
CVE-2021-34301 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34300 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected a… |
CVE-2021-34298 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34297 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34296 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-34295 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected ap… |
CVE-2021-34294 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected ap… |
CVE-2021-34293 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected ap… |
CVE-2021-34292 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected a… |
CVE-2021-34291 | High | 7.8 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected ap… |
CVE-2021-1970 | High | 7.5 | 2021-07-13 | Possible out of bound read due to lack of length check of FT sub-elements in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2021-1965 | Critical | 9.8 | 2021-07-13 | Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2021-32707 | Medium | 4.3 | 2021-07-12 | Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not lea… |
CVE-2021-33012 | High | 8.6 | 2021-07-09 | Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when… |
CVE-2021-3612 | High | 7.8 | 2021-07-09 | An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOC… |
CVE-2021-1562 | Medium | 4.3 | 2021-07-08 | A vulnerability in the XSI-Actions interface of Cisco BroadWorks Application Server could allow an authenticated, remote attacker to access sensitive informati… |
CVE-2021-25441 | High | 7.8 | 2021-07-08 | Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applications to access arbit… |
CVE-2021-25437 | Critical | 9.8 | 2021-07-08 | Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code execution by replacing… |
CVE-2021-25436 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via Samsung Accessory P… |
CVE-2021-25435 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using recovery partition… |
CVE-2021-25434 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using param partition in… |
CVE-2021-25428 | High | 7.8 | 2021-07-08 | Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission with… |
CVE-2021-31925 | High | 7.5 | 2021-07-07 | Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative… |
CVE-2020-25868 | High | 7.5 | 2021-07-07 | Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (tem… |
CVE-2021-26036 | High | 7.5 | 2021-07-07 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table. |
CVE-2021-27660 | High | 8.8 | 2021-07-01 | An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs. |
CVE-2021-22349 | High | 7.5 | 2021-06-30 | There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of insufficient input verification may cause the system to restart. |
CVE-2021-34374 | High | 7.7 | 2021-06-30 | Trusty contains a vulnerability in command handlers where the length of input buffers is not verified. This vulnerability can cause memory corruption, which ma… |
CVE-2021-32567 | High | 7.5 | 2021-06-30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0… |
CVE-2021-32566 | High | 7.5 | 2021-06-30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0… |
CVE-2020-7870 | Medium | 6.4 | 2021-06-29 | A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter. |
CVE-2020-7869 | Critical | 9.0 | 2021-06-29 | An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewe… |
CVE-2020-7871 | High | 7.5 | 2021-06-29 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of th… |
CVE-2021-28585 | Medium | 5.3 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New c… |
CVE-2021-34427 | Critical | 9.8 | 2021-06-25 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir)… |
CVE-2021-20583 | Medium | 4.9 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP GET request by a privileged user due to… |
CVE-2021-31412 | Medium | 5.3 | 2021-06-24 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0… |
CVE-2020-7862 | High | 7.0 | 2021-06-24 | A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability… |
CVE-2021-35041 | High | 7.5 | 2021-06-24 | The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuous… |
CVE-2021-22377 | High | 7.2 | 2021-06-22 | There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V20… |
CVE-2021-32697 | Medium | 6.5 | 2021-06-21 | neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without i… |
CVE-2021-0511 | High | 7.8 | 2021-06-21 | In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This could lead to local escalation of privi… |
CVE-2021-1570 | Medium | 6.5 | 2021-06-16 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive i… |
CVE-2021-1569 | Medium | 6.5 | 2021-06-16 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive i… |
CVE-2021-1524 | Medium | 4.3 | 2021-06-16 | A vulnerability in the API of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected de… |
CVE-2020-27339 | Medium | 6.7 | 2021-06-16 | In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt… |
CVE-2021-27388 | Critical | 9.8 | 2021-06-15 | SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated at… |
CVE-2021-27196 | High | 7.5 | 2021-06-14 | Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU5… |
CVE-2021-21557 | High | 8.1 | 2021-06-14 | Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges… |
CVE-2020-12986 | High | 7.8 | 2021-06-11 | An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may cause arbitrary code execution in the kernel, leading to escalat… |
CVE-2020-12985 | High | 7.8 | 2021-06-11 | An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |
CVE-2021-0485 | High | 7.8 | 2021-06-11 | In getMinimalSize of PipBoundsAlgorithm.java, there is a possible bypass of restrictions on background processes due to a permissions bypass. This could lead t… |
CVE-2021-0481 | High | 7.8 | 2021-06-11 | In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. This could lead to loca… |
CVE-2021-22768 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22767 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22766 | High | 7.5 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22765 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-25416 | Medium | 6.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outs… |
CVE-2021-25415 | Medium | 5.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. |
CVE-2021-25414 | High | 7.8 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with S… |
CVE-2021-25413 | Medium | 5.5 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to access arbitrary data… |
CVE-2021-25411 | Medium | 4.4 | 2021-06-11 | Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory. |
CVE-2021-25410 | High | 7.1 | 2021-06-11 | Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated pri… |
CVE-2021-25401 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. |
CVE-2021-25684 | High | 8.8 | 2021-06-11 | It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. |
CVE-2021-25683 | High | 8.8 | 2021-06-11 | It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. |
CVE-2021-25682 | High | 8.8 | 2021-06-11 | It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. |
CVE-2021-20329 | Medium | 6.8 | 2021-06-10 | Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object wi… |
CVE-2021-0134 | Medium | 4.9 | 2021-06-09 | Improper input validation in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially enable denial of service vi… |
CVE-2021-0051 | Medium | 4.4 | 2021-06-09 | Improper input validation in the Intel(R) SPS versions before SPS_E5_04.04.04.023.0, SPS_E5_04.04.03.228.0 or SPS_SoC-A_05.00.03.098.0 may allow a privileged u… |
CVE-2021-0070 | High | 8.8 | 2021-06-09 | Improper input validation in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated use… |
CVE-2020-8700 | Medium | 6.7 | 2021-06-09 | Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2020-24486 | Medium | 5.5 | 2021-06-09 | Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12295 | Medium | 5.5 | 2021-06-09 | Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-15379 | High | 7.5 | 2021-06-09 | Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-suppl… |
CVE-2021-23853 | High | 8.3 | 2021-06-09 | In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs. |
CVE-2021-33661 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33660 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33659 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27643 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27642 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27641 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27640 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27639 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2021-27638 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2020-11261 | High | 7.8 | 2021-06-09 | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-11178 | High | 7.8 | 2021-06-09 | Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping with its memory and its RoT memory in Snapd… |
CVE-2020-26138 | Medium | 5.3 | 2021-06-08 | In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. |
CVE-2021-22116 | High | 7.5 | 2021-06-08 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A… |
CVE-2021-3490 | High | 7.8 | 2021-06-04 | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of b… |
CVE-2021-32666 | Medium | 6.5 | 2021-06-03 | wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that can cause a denial… |
CVE-2021-32635 | Medium | 6.3 | 2021-05-28 | Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shel… |
CVE-2021-29507 | Medium | 5.7 | 2021-05-28 | GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing… |
CVE-2021-32642 | High | 7.0 | 2021-05-28 | radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` a… |
CVE-2021-29629 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and… |
CVE-2021-33620 | Medium | 6.5 | 2021-05-28 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The iss… |