CWE-20 · Improper Input Validation (page 49)
Page 49 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1432 | High | 7.3 | 2021-03-24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operati… |
CVE-2021-1431 | High | 7.5 | 2021-03-24 | A vulnerability in the vDaemon process of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a device to reload, resulting a… |
CVE-2021-1383 | Medium | 6.0 | 2021-03-24 | Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with… |
CVE-2020-7839 | High | 8.8 | 2021-03-24 | In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter. |
CVE-2021-20222 | High | 7.5 | 2021-03-23 | A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this… |
CVE-2021-21357 | High | 8.3 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, att… |
CVE-2021-21267 | High | 7.5 | 2021-03-19 | Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation i… |
CVE-2020-25097 | High | 8.6 | 2021-03-19 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smugg… |
CVE-2021-20631 | Medium | 6.5 | 2021-03-18 | Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspe… |
CVE-2021-21726 | Low | 2.3 | 2021-03-12 | Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by u… |
CVE-2021-21085 | High | 7.8 | 2021-03-12 | Adobe Connect version 11.0.7 (and earlier) is affected by an Input Validation vulnerability in the export feature. An attacker could exploit this vulnerability… |
CVE-2021-21069 | High | 7.8 | 2021-03-12 | Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a local privilege escalation vulnerability that could allow an attacker to ca… |
CVE-2021-0377 | Medium | 5.5 | 2021-03-10 | In DeltaPerformer::Write of delta_performer.cc, there is a possible use of untrusted input due to improper input validation. This could lead to a local bypass… |
CVE-2021-20671 | High | 7.2 | 2021-03-10 | Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the ser… |
CVE-2021-20268 | High | 7.8 | 2021-03-09 | An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_i… |
CVE-2021-20273 | High | 7.5 | 2021-03-09 | A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off. |
CVE-2021-21510 | Medium | 6.1 | 2021-03-08 | Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnera… |
CVE-2021-21506 | High | 8.8 | 2021-03-08 | PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISI_PRIV_SYS_SUPPORT and ISI… |
CVE-2021-26788 | High | 7.5 | 2021-03-08 | Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a denial of service (DoS). To exploit the v… |
CVE-2020-29029 | High | 7.3 | 2021-03-05 | Improper Input Validation, Cross-site Scripting (XSS) vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code… |
CVE-2021-25339 | Medium | 4.4 | 2021-03-04 | Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to corrupt EL2 me… |
CVE-2021-25338 | Medium | 4.4 | 2021-03-04 | Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel, to write certai… |
CVE-2021-25334 | Medium | 5.5 | 2021-03-04 | Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause permanent denial of s… |
CVE-2021-23131 | High | 7.5 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager. |
CVE-2021-21978 | Critical | 9.8 | 2021-03-03 | VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leadi… |
CVE-2020-28591 | Medium | 6.5 | 2021-03-03 | An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A… |
CVE-2021-27923 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-27922 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-27921 | High | 7.5 | 2021-03-03 | Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked f… |
CVE-2021-21322 | Critical | 10.0 | 2021-03-02 | fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is… |
CVE-2021-21321 | Critical | 10.0 | 2021-03-02 | fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0… |
CVE-2018-25004 | Medium | 4.9 | 2021-03-01 | A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affec… |
CVE-2021-0404 | Medium | 4.4 | 2021-02-26 | In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execu… |
CVE-2021-1450 | Medium | 5.5 | 2021-02-24 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to caus… |
CVE-2021-1367 | Medium | 4.3 | 2021-02-24 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial… |
CVE-2020-11988 | High | 8.2 | 2021-02-24 | Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a speci… |
CVE-2020-11987 | High | 8.2 | 2021-02-24 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argume… |
CVE-2021-20252 | Medium | 6.5 | 2021-02-23 | A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain… |
CVE-2021-20194 | High | 7.8 | 2021-02-23 | There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROU… |
CVE-2021-20247 | High | 7.4 | 2021-02-23 | A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromis… |
CVE-2020-29075 | High | 7.1 | 2021-02-23 | Acrobat Reader DC versions 2020.013.20066 (and earlier), 2020.001.30010 (and earlier) and 2017.011.30180 (and earlier) are affected by an information exposure… |
CVE-2020-11253 | High | 7.8 | 2021-02-22 | Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Con… |
CVE-2020-11204 | High | 7.8 | 2021-02-22 | Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from sh… |
CVE-2020-11195 | High | 7.8 | 2021-02-22 | Out of bound write and read in TA while processing command from NS side due to improper length check on command and response buffers in Snapdragon Auto, Snapdr… |
CVE-2020-11194 | High | 7.8 | 2021-02-22 | Possible out of bound access in TA while processing a command from NS side due to improper length check of response buffer in Snapdragon Auto, Snapdragon Compu… |
CVE-2020-7849 | High | 8.0 | 2021-02-17 | A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to… |
CVE-2020-7848 | High | 8.0 | 2021-02-17 | The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can se… |
CVE-2020-24505 | Medium | 4.4 | 2021-02-17 | Insufficient input validation in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially… |
CVE-2020-24502 | Medium | 5.5 | 2021-02-17 | Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an… |
CVE-2020-24496 | Medium | 4.4 | 2021-02-17 | Insufficient input validation in the firmware for Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable deni… |
CVE-2020-24491 | Medium | 4.4 | 2021-02-17 | Debug message containing addresses of memory transactions in some Intel(R) 10th Generation Core Processors supporting SGX may allow a privileged user to potent… |
CVE-2020-24453 | High | 7.8 | 2021-02-17 | Improper input validation in the Intel(R) EPID SDK before version 8, may allow an authenticated user to potentially enable an escalation of privilege via local… |
CVE-2020-24452 | Medium | 5.5 | 2021-02-17 | Improper input validation in the Intel(R) SGX Platform Software for Windows* may allow an authenticated user to potentially enable a denial of service via loca… |
CVE-2020-12385 | High | 7.8 | 2021-02-17 | Improper input validation in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable escalation of privi… |
CVE-2020-12377 | High | 7.8 | 2021-02-17 | Insufficient input validation in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow an authenti… |
CVE-2020-12366 | High | 7.8 | 2021-02-17 | Insufficient input validation in some Intel(R) Graphics Drivers before version 27.20.100.8587 may allow a privileged user to potentially enable an escalation o… |
CVE-2020-12363 | Medium | 5.5 | 2021-02-17 | Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileg… |
CVE-2020-7071 | Medium | 5.3 | 2021-02-15 | In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accep… |
CVE-2021-21060 | Medium | 4.6 | 2021-02-11 | Adobe Acrobat Pro DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper input val… |
CVE-2021-27179 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02… |
CVE-2020-28870 | Critical | 9.8 | 2021-02-10 | In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp… |
CVE-2020-26193 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISI_PRIV_CLUSTER privilege may exploit thi… |
CVE-2020-14343 | Critical | 9.8 | 2021-02-09 | A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YA… |
CVE-2020-28645 | Critical | 9.1 | 2021-02-09 | Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data dire… |
CVE-2020-4790 | Medium | 6.5 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering… |
CVE-2021-21126 | Medium | 6.5 | 2021-02-09 | Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Ex… |
CVE-2021-21123 | Medium | 6.5 | 2021-02-09 | Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafte… |
CVE-2020-29021 | Low | 3.5 | 2021-02-08 | A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager a… |
CVE-2020-12122 | High | 7.8 | 2021-02-05 | In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifi… |
CVE-2021-0350 | Medium | 4.4 | 2021-02-04 | In ged, there is a possible system crash due to an improper input validation. This could lead to local denial of service with System execution privileges neede… |
CVE-2021-0345 | Medium | 6.7 | 2021-02-04 | In mobile_log_d, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System exe… |
CVE-2021-1318 | High | 7.2 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an aut… |
CVE-2021-1317 | High | 7.2 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an aut… |
CVE-2021-1316 | High | 7.2 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an aut… |
CVE-2021-1315 | High | 7.2 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an aut… |
CVE-2021-1314 | High | 7.2 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an aut… |
CVE-2021-1221 | Medium | 4.1 | 2021-02-04 | A vulnerability in the user interface of Cisco Webex Meetings and Cisco Webex Meetings Server Software could allow an authenticated, remote attacker to inject… |
CVE-2020-4828 | Medium | 6.5 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to web cache poisoning, caused by improper input validation by modif… |
CVE-2020-8734 | Medium | 6.7 | 2021-02-02 | Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalation… |
CVE-2021-3176 | High | 8.0 | 2021-01-29 | The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to use… |
CVE-2021-3195 | High | 7.5 | 2021-01-26 | bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOT… |
CVE-2020-36199 | Critical | 9.8 | 2021-01-26 | TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places. |
CVE-2020-28221 | Critical | 9.8 | 2021-01-26 | A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that… |
CVE-2020-0236 | High | 7.5 | 2021-01-26 | In A2DP_GetCodecType of a2dp_codec_config, there is a possible out-of-bounds read due to improper input validation. This could lead to remote information discl… |
CVE-2020-17532 | High | 8.8 | 2021-01-25 | When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem h… |
CVE-2020-8568 | Medium | 5.8 | 2021-01-21 | Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to… |
CVE-2020-11200 | High | 7.5 | 2021-01-21 | Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2020-11144 | Critical | 9.1 | 2021-01-21 | Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto, Snapdragon Com… |
CVE-2020-11119 | High | 7.5 | 2021-01-21 | Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute… |
CVE-2021-1250 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator… |
CVE-2021-1249 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator… |
CVE-2021-1233 | Medium | 4.4 | 2021-01-20 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information on an affected device. The vul… |
CVE-2021-1142 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands… |
CVE-2021-1141 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands… |
CVE-2021-1140 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands… |
CVE-2021-1139 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands… |
CVE-2021-1138 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands… |
CVE-2021-1305 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authori… |
CVE-2021-1304 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authori… |
CVE-2021-1302 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authori… |