CWE-20 · Improper Input Validation (page 49)
Page 49 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20707 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUST… |
CVE-2021-20706 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X… |
CVE-2021-20705 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X… |
CVE-2021-37996 | Medium | 5.5 | 2021-11-02 | Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a m… |
CVE-2017-5123 | High | 8.8 | 2021-11-02 | Insufficient data validation in waitid allowed an user to escape sandboxes on Linux. |
CVE-2021-25742 | High | 7.6 | 2021-10-29 | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secre… |
CVE-2021-22491 | High | 7.5 | 2021-10-28 | There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-22467 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to read at any address. |
CVE-2021-22457 | Low | 3.3 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to cause out-of-bounds write. |
CVE-2021-22452 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Improper Input Validation vulnerability. Local attackers may exploit this vulnerability to read at any address. |
CVE-2021-34791 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-34790 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-34783 | High | 8.6 | 2021-10-27 | A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software c… |
CVE-2021-34756 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2021-34755 | Medium | 6.7 | 2021-10-27 | Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2020-7867 | High | 8.0 | 2021-10-27 | An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer… |
CVE-2011-4124 | Critical | 9.8 | 2021-10-27 | Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges. |
CVE-2021-41173 | Medium | 5.7 | 2021-10-26 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing… |
CVE-2021-26607 | High | 8.1 | 2021-10-26 | An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems. |
CVE-2021-41105 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-39220 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render im… |
CVE-2021-38485 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any… |
CVE-2021-0651 | Medium | 5.5 | 2021-10-22 | In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to incorrect input validation. This could le… |
CVE-2021-38455 | High | 7.3 | 2021-10-22 | The affected product’s OS Service does not verify any given parameter. A user can supply any type of parameter that will be passed to inner calls without check… |
CVE-2021-41168 | Medium | 6.5 | 2021-10-21 | Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vu… |
CVE-2021-34736 | Medium | 5.3 | 2021-10-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker… |
CVE-2021-35611 | Medium | 4.3 | 2021-10-20 | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Offline Template). Supported versions that are affected are 12.1.1-12… |
CVE-2021-30310 | High | 7.5 | 2021-10-20 | Possible buffer overflow due to Improper validation of received CF-ACK and CF-Poll data frames in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2021-30305 | High | 8.4 | 2021-10-20 | Possible out of bound access due to lack of validation of page offset before page is inserted in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industria… |
CVE-2021-1969 | Medium | 6.2 | 2021-10-20 | Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snap… |
CVE-2021-1968 | Medium | 6.2 | 2021-10-20 | Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snap… |
CVE-2021-31376 | High | 7.5 | 2021-10-19 | An Improper Input Validation vulnerability in Packet Forwarding Engine manager (FXPC) process of Juniper Networks Junos OS allows an attacker to cause a Denial… |
CVE-2021-31375 | High | 7.2 | 2021-10-19 | An Improper Input Validation vulnerability in routing process daemon (RPD) of Juniper Networks Junos OS devices configured with BGP origin validation using Res… |
CVE-2021-31373 | High | 8.0 | 2021-10-19 | A persistent Cross-Site Scripting (XSS) vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inje… |
CVE-2021-31372 | High | 8.8 | 2021-10-19 | An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated J-Web attacker to escalate their privileges to… |
CVE-2021-31360 | High | 7.1 | 2021-10-19 | An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows a low-privileged use… |
CVE-2021-41138 | Medium | 5.3 | 2021-10-13 | Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transac… |
CVE-2021-33609 | Medium | 4.3 | 2021-10-13 | Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network at… |
CVE-2021-42009 | Medium | 4.3 | 2021-10-12 | An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliver… |
CVE-2021-42257 | High | 7.1 | 2021-10-11 | check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path (the /dev/bus sub… |
CVE-2021-25738 | Medium | 6.7 | 2021-10-11 | Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution. |
CVE-2021-41133 | High | 8.8 | 2021-10-08 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with… |
CVE-2021-1534 | Medium | 5.8 | 2021-10-06 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2021-25489 | Low | 3.3 | 2021-10-06 | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to… |
CVE-2021-25485 | High | 7.5 | 2021-10-06 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket. |
CVE-2021-25471 | Low | 3.7 | 2021-10-06 | A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile network connection… |
CVE-2021-25468 | Medium | 4.4 | 2021-10-06 | A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory a… |
CVE-2021-41114 | Medium | 4.8 | 2021-10-05 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofi… |
CVE-2021-21705 | Medium | 4.3 | 2021-10-04 | In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VAL… |
CVE-2020-18685 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP po… |
CVE-2020-18683 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling. |
CVE-2021-28547 | High | 7.8 | 2021-09-29 | Adobe Creative Cloud Desktop Application for macOS version 5.3 (and earlier) is affected by a privilege escalation vulnerability that could allow a normal user… |
CVE-2021-36283 | High | 7.5 | 2021-09-28 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2021-40712 | Medium | 6.5 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attack… |
CVE-2021-34416 | Critical | 9.8 | 2021-09-27 | The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Conne… |
CVE-2021-34414 | High | 7.2 | 2021-09-27 | The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connecto… |
CVE-2021-34570 | High | 7.5 | 2021-09-27 | Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests. |
CVE-2021-41583 | Medium | 6.5 | 2021-09-24 | vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS… |
CVE-2021-34714 | High | 7.4 | 2021-09-23 | A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software, Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, a… |
CVE-2021-3583 | High | 7.1 | 2021-09-22 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user… |
CVE-2021-39230 | High | 8.8 | 2021-09-21 | Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel… |
CVE-2021-41531 | High | 7.5 | 2021-09-21 | NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to… |
CVE-2021-25741 | High | 8.8 | 2021-09-20 | A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside o… |
CVE-2021-41380 | Medium | 6.5 | 2021-09-17 | RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that thi… |
CVE-2020-12080 | High | 7.5 | 2021-09-17 | A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause… |
CVE-2021-38304 | High | 7.8 | 2021-09-17 | Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable escalation o… |
CVE-2021-30261 | High | 8.4 | 2021-09-17 | Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in Snapdragon Auto, Sna… |
CVE-2021-30260 | High | 8.4 | 2021-09-17 | Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is rece… |
CVE-2021-41079 | High | 7.5 | 2021-09-16 | Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO… |
CVE-2021-37909 | Critical | 9.8 | 2021-09-15 | WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus… |
CVE-2021-23030 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions… |
CVE-2021-23028 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs… |
CVE-2021-23036 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause the Traffic Manage… |
CVE-2021-23039 | High | 7.5 | 2021-09-14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configured on a BIG-IP sy… |
CVE-2021-23035 | High | 7.5 | 2021-09-14 | On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked responses can cause the… |
CVE-2021-23034 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual server, undisclosed r… |
CVE-2021-23033 | High | 7.5 | 2021-09-14 | On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of… |
CVE-2021-23032 | High | 7.5 | 2021-09-14 | On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured wi… |
CVE-2021-23045 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when an SCTP prof… |
CVE-2021-23044 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when the I… |
CVE-2021-20569 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243. |
CVE-2021-23051 | High | 7.5 | 2021-09-14 | On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP on Amazon Web S… |
CVE-2021-23048 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x, when G… |
CVE-2021-37206 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All version… |
CVE-2021-25465 | Low | 3.3 | 2021-09-09 | An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. |
CVE-2021-25457 | Medium | 5.9 | 2021-09-09 | An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information. |
CVE-2021-25453 | Medium | 5.1 | 2021-09-09 | Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information. |
CVE-2021-25452 | Medium | 5.5 | 2021-09-09 | An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of… |
CVE-2021-25450 | Medium | 4.5 | 2021-09-09 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket. |
CVE-2021-1960 | Medium | 6.5 | 2021-09-09 | Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-24672 | Critical | 9.8 | 2021-09-08 | A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue aff… |
CVE-2021-30693 | High | 7.8 | 2021-09-08 | A validation issue was addressed with improved logic. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mo… |
CVE-2021-30681 | High | 7.8 | 2021-09-08 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2… |
CVE-2021-30671 | Low | 3.3 | 2021-09-08 | A validation issue was addressed with improved logic. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may… |
CVE-2021-1807 | Medium | 5.5 | 2021-09-08 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4. A local user may be able to wr… |
CVE-2021-30763 | Medium | 5.5 | 2021-09-08 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.7, watchOS 7.6. A shortcut may be able to bypass Internet… |
CVE-2021-39263 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. |
CVE-2021-39262 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22. |
CVE-2021-39261 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22. |
CVE-2021-39260 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22. |