CWE-20 · Improper Input Validation (page 48)
Page 48 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20195 | Critical | 9.6 | 2021-05-28 | A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-suppl… |
CVE-2020-15180 | Critical | 9.0 | 2021-05-27 | A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited b… |
CVE-2021-22359 | High | 7.5 | 2021-05-27 | There is a denial of service vulnerability in the verisions V200R005C00SPC500 of S5700 and V200R005C00SPC500 of S6700. An attacker could exploit this vulnerabi… |
CVE-2021-22358 | Medium | 4.3 | 2021-05-27 | There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulne… |
CVE-2021-30501 | Medium | 5.5 | 2021-05-27 | An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a c… |
CVE-2021-28170 | Medium | 5.3 | 2021-05-26 | In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if the… |
CVE-2021-20297 | Medium | 5.5 | 2021-05-26 | A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this… |
CVE-2021-22699 | High | 7.5 | 2021-05-26 | Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specif… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2020-13602 | Medium | 4.0 | 2021-05-25 | Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit C… |
CVE-2020-36332 | High | 7.5 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnera… |
CVE-2021-3531 | Medium | 5.3 | 2021-05-18 | A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can ca… |
CVE-2021-3524 | Medium | 6.5 | 2021-05-17 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP he… |
CVE-2020-27833 | High | 7.1 | 2021-05-14 | A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container i… |
CVE-2021-29611 | Low | 3.6 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHEC… |
CVE-2020-4811 | Low | 2.4 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a special… |
CVE-2021-23906 | Low | 1.8 | 2021-05-13 | An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQ… |
CVE-2020-27823 | High | 7.8 | 2021-05-13 | A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest… |
CVE-2020-25713 | Medium | 6.5 | 2021-05-13 | A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common. |
CVE-2020-27824 | Medium | 5.5 | 2021-05-13 | A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decompos… |
CVE-2020-12526 | Medium | 5.3 | 2021-05-13 | TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable… |
CVE-2021-22152 | Medium | 5.5 | 2021-05-13 | A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and… |
CVE-2020-26146 | Medium | 5.3 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numb… |
CVE-2020-26145 | Medium | 6.5 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragment… |
CVE-2020-26144 | Medium | 6.5 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the fi… |
CVE-2020-26143 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext fram… |
CVE-2021-31198 | High | 7.8 | 2021-05-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2021-27617 | Medium | 4.9 | 2021-05-11 | The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML documen… |
CVE-2021-32471 | High | 7.8 | 2021-05-10 | Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via craft… |
CVE-2020-11268 | High | 7.5 | 2021-05-07 | Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile |
CVE-2021-1519 | Medium | 4.7 | 2021-05-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacke… |
CVE-2021-1514 | High | 7.8 | 2021-05-06 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with Administrator… |
CVE-2021-1513 | High | 7.5 | 2021-05-06 | A vulnerability in the vDaemon process of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting in a den… |
CVE-2021-1508 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1506 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1505 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1468 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1275 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-29242 | High | 7.3 | 2021-05-03 | CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressin… |
CVE-2021-29486 | High | 7.5 | 2021-04-30 | cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values… |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2021-29468 | High | 8.8 | 2021-04-29 | Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as file… |
CVE-2021-1085 | High | 7.3 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memory location and man… |
CVE-2021-1084 | High | 7.8 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated, w… |
CVE-2021-1080 | High | 7.8 | 2021-04-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which may lead to informa… |
CVE-2021-21388 | High | 8.9 | 2021-04-29 | systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systemi… |
CVE-2021-1448 | High | 7.8 | 2021-04-29 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with roo… |
CVE-2021-1402 | High | 8.6 | 2021-04-29 | A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker… |
CVE-2021-31863 | High | 7.5 | 2021-04-28 | Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to rea… |
CVE-2020-4981 | Medium | 6.0 | 2021-04-27 | IBM Spectrum Scale 5.0.4.1 through 5.1.0.3 could allow a local privileged user to overwrite files due to improper input validation. IBM X-Force ID: 192541. |
CVE-2021-29474 | Medium | 4.7 | 2021-04-26 | HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the server's filesystem du… |
CVE-2021-21221 | Medium | 6.5 | 2021-04-26 | Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2021-21208 | Medium | 6.5 | 2021-04-26 | Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing vi… |
CVE-2021-22678 | High | 7.8 | 2021-04-23 | Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An atta… |
CVE-2021-0267 | High | 7.4 | 2021-04-22 | An Improper Input Validation vulnerability in the active-lease query portion in JDHCPD's DHCP Relay Agent of Juniper Networks Junos OS allows an attacker to ca… |
CVE-2021-0214 | Medium | 6.5 | 2021-04-22 | A vulnerability in the distributed or centralized periodic packet management daemon (PPMD) of Juniper Networks Junos OS may cause receipt of a malformed packet… |
CVE-2021-31555 | High | 7.5 | 2021-04-22 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version)… |
CVE-2021-29462 | High | 7.6 | 2021-04-20 | The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vul… |
CVE-2020-7857 | High | 7.5 | 2021-04-20 | A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of… |
CVE-2021-3038 | Medium | 5.5 | 2021-04-20 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted i… |
CVE-2020-36195 | Critical | 9.8 | 2021-04-17 | An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability a… |
CVE-2021-29432 | Medium | 5.3 | 2021-04-15 | Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be use… |
CVE-2021-29431 | High | 7.7 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP ad… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2020-28898 | Medium | 5.3 | 2021-04-15 | In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to… |
CVE-2021-29433 | Medium | 4.3 | 2021-04-15 | Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm… |
CVE-2021-26415 | High | 7.8 | 2021-04-13 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-23279 | High | 8.0 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validati… |
CVE-2021-23278 | High | 8.7 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation… |
CVE-2021-0400 | Medium | 5.5 | 2021-04-13 | In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due… |
CVE-2020-28590 | Medium | 6.5 | 2021-04-13 | An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A s… |
CVE-2021-29425 | Medium | 4.8 | 2021-04-13 | In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result wou… |
CVE-2021-21393 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21394 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-25378 | Medium | 4.3 | 2021-04-09 | Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service. |
CVE-2021-25356 | High | 7.1 | 2021-04-09 | An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application… |
CVE-2021-21431 | High | 7.6 | 2021-04-09 | sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick… |
CVE-2021-3482 | Medium | 6.5 | 2021-04-08 | A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp… |
CVE-2021-1404 | High | 7.5 | 2021-04-08 | A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to c… |
CVE-2021-1252 | High | 7.5 | 2021-04-08 | A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote a… |
CVE-2021-1480 | High | 7.8 | 2021-04-08 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated… |
CVE-2021-1459 | Critical | 9.8 | 2021-04-08 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote… |
CVE-2021-1137 | High | 7.8 | 2021-04-08 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated… |
CVE-2020-11237 | High | 8.4 | 2021-04-07 | Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon C… |
CVE-2021-21404 | High | 7.5 | 2021-04-06 | Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by se… |
CVE-2021-29136 | Medium | 5.5 | 2021-04-06 | Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci u… |
CVE-2021-21533 | Medium | 4.3 | 2021-04-02 | Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrie… |
CVE-2021-21532 | Medium | 5.0 | 2021-04-02 | Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be potentially exploited to redirect a clie… |
CVE-2021-1748 | High | 8.8 | 2021-04-02 | A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a malici… |
CVE-2020-10001 | Medium | 5.5 | 2021-04-02 | An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security U… |
CVE-2021-30004 | Medium | 5.3 | 2021-04-02 | In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. |
CVE-2021-22538 | Medium | 6.3 | 2021-03-31 | A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has… |
CVE-2021-29418 | Medium | 5.3 | 2021-03-30 | The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situa… |
CVE-2018-1110 | High | 7.5 | 2021-03-30 | A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service. |
CVE-2021-21372 | High | 8.3 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places… |
CVE-2021-20206 | High | 7.2 | 2021-03-26 | An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field… |
CVE-2021-1356 | Medium | 4.3 | 2021-03-24 | Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI sof… |
CVE-2021-1220 | Medium | 4.3 | 2021-03-24 | Multiple vulnerabilities in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to cause the web UI sof… |
CVE-2021-1469 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-1454 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |