CWE-20 · Improper Input Validation (page 50)
Page 50 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39259 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22. |
CVE-2021-39258 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22. |
CVE-2021-39256 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22. |
CVE-2021-39255 | High | 7.8 | 2021-09-07 | A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22. |
CVE-2021-39254 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 20… |
CVE-2021-39253 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22. |
CVE-2021-39252 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22. |
CVE-2021-39251 | High | 7.8 | 2021-09-07 | A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22. |
CVE-2021-33287 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow… |
CVE-2020-7865 | High | 8.8 | 2021-09-07 | A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpD… |
CVE-2020-7832 | High | 8.8 | 2021-09-07 | A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUp… |
CVE-2021-35268 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing… |
CVE-2021-33285 | High | 7.8 | 2021-09-07 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur… |
CVE-2021-39193 | Medium | 5.3 | 2021-09-03 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause inv… |
CVE-2021-35995 | Low | 3.3 | 2021-09-02 | Adobe After Effects version 18.2.1 (and earlier) is affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenti… |
CVE-2021-39186 | Medium | 4.3 | 2021-09-01 | GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the Glo… |
CVE-2021-36048 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36047 | High | 7.8 | 2021-09-01 | XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the… |
CVE-2021-36044 | High | 7.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An un… |
CVE-2021-36042 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the… |
CVE-2021-36041 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36040 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36038 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the… |
CVE-2021-36035 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36034 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An at… |
CVE-2021-36032 | High | 8.3 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An au… |
CVE-2021-36030 | High | 7.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during… |
CVE-2021-36025 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while… |
CVE-2020-9002 | High | 7.5 | 2021-09-01 | An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRole… |
CVE-2021-35223 | High | 8.5 | 2021-08-31 | The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that ca… |
CVE-2021-32759 | High | 7.2 | 2021-08-27 | OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it… |
CVE-2021-1588 | High | 8.6 | 2021-08-25 | A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to… |
CVE-2021-22245 | Low | 2.7 | 2021-08-25 | Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view |
CVE-2021-30917 | High | 7.8 | 2021-08-24 | A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in iOS 15.1 a… |
CVE-2021-30881 | High | 7.8 | 2021-08-24 | An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, tvOS 15.1, watch… |
CVE-2021-30862 | Medium | 6.1 | 2021-08-24 | A validation issue was addressed with improved input sanitization. This issue is fixed in iTunes U 3.8.3. Processing a maliciously crafted URL may lead to arbi… |
CVE-2021-22357 | High | 7.5 | 2021-08-23 | There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers c… |
CVE-2021-36014 | Low | 3.3 | 2021-08-20 | Adobe Media Encoder version 15.2 (and earlier) is affected by an uninitialized pointer vulnerability when parsing a specially crafted file. An unauthenticated… |
CVE-2021-36007 | Low | 3.3 | 2021-08-20 | Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-36006 | Low | 3.3 | 2021-08-20 | Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) are affected by an Improper input validation vulnerability when parsing a specially craf… |
CVE-2021-31401 | High | 7.5 | 2021-08-19 | An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total len… |
CVE-2020-35684 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP head… |
CVE-2021-0419 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0418 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0417 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-0416 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-20775 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the data of Comment and S… |
CVE-2021-20764 | Medium | 5.3 | 2021-08-18 | Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Attaching Files. |
CVE-2021-20762 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail without the appropr… |
CVE-2021-20761 | Low | 2.7 | 2021-08-18 | Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege to alter the data o… |
CVE-2021-20760 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of User Profil… |
CVE-2021-20754 | Medium | 4.3 | 2021-08-18 | Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Workflow withou… |
CVE-2021-37707 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6… |
CVE-2021-22931 | Critical | 9.8 | 2021-08-16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names retu… |
CVE-2021-37586 | Medium | 4.9 | 2021-08-13 | The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previousl… |
CVE-2021-37692 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions under certain conditions, Go code can trigger a segfault in string… |
CVE-2021-37677 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerab… |
CVE-2021-37674 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a segmentation faul… |
CVE-2021-37673 | Medium | 5.5 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a `CHECK`-fail in `… |
CVE-2021-37665 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementation of requantizatio… |
CVE-2021-37663 | High | 7.8 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacke… |
CVE-2021-33199 | Critical | 9.8 | 2021-08-12 | In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file na… |
CVE-2021-36982 | High | 8.1 | 2021-08-12 | AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Injection because of miss… |
CVE-2021-1110 | High | 7.1 | 2021-08-11 | NVIDIA Linux kernel distributions on Jetson Xavier contain a vulnerability in camera firmware where a user can change input data after validation, which may le… |
CVE-2021-3048 | Medium | 5.9 | 2021-08-11 | Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subs… |
CVE-2021-0084 | High | 7.8 | 2021-08-11 | Improper input validation in the Intel(R) Ethernet Controllers X722 and 800 series Linux RMDA driver before version 1.3.19 may allow an authenticated user to p… |
CVE-2021-0083 | Medium | 4.4 | 2021-08-11 | Improper input validation in some Intel(R) Optane(TM) PMem versions before versions 1.2.0.5446 or 2.2.0.1547 may allow a privileged user to potentially enable… |
CVE-2021-0062 | High | 7.8 | 2021-08-11 | Improper input validation in some Intel(R) Graphics Drivers before version 27.20.100.8935 may allow an authenticated user to potentially enable escalation of p… |
CVE-2021-33708 | High | 8.8 | 2021-08-10 | Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges. |
CVE-2021-33706 | Medium | 4.3 | 2021-08-10 | Due to improper input validation in InfraBox, logs can be modified by an authenticated user. |
CVE-2021-29714 | Medium | 6.5 | 2021-08-09 | IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968. |
CVE-2021-26606 | Critical | 9.8 | 2021-08-06 | A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the… |
CVE-2021-3655 | Low | 3.3 | 2021-08-05 | A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uni… |
CVE-2021-3580 | High | 7.5 | 2021-08-05 | A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ci… |
CVE-2021-26605 | High | 7.5 | 2021-08-05 | An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launc… |
CVE-2021-22924 | Low | 3.7 | 2021-08-05 | libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, t… |
CVE-2020-7863 | High | 8.8 | 2021-08-05 | A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulner… |
CVE-2021-25444 | Medium | 5.5 | 2021-08-05 | An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. |
CVE-2021-1602 | High | 8.2 | 2021-08-04 | A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticat… |
CVE-2021-30589 | Medium | 4.3 | 2021-08-03 | Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2021-22400 | Medium | 5.5 | 2021-08-03 | Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installin… |
CVE-2021-37914 | Medium | 6.5 | 2021-08-03 | In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an atta… |
CVE-2021-3673 | High | 7.5 | 2021-08-02 | A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS. |
CVE-2021-33196 | High | 7.5 | 2021-08-02 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. |
CVE-2021-22445 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. |
CVE-2021-22444 | Critical | 9.8 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection. |
CVE-2021-22443 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random address access. |
CVE-2021-22397 | Medium | 6.7 | 2021-08-02 | There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. At… |
CVE-2021-22381 | High | 7.5 | 2021-08-02 | There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS. |
CVE-2021-33527 | Critical | 9.8 | 2021-08-02 | In MB connect line mbDIALUP versions <= 3.9R0.0 a remote attacker can send a specifically crafted HTTP request to the service running with NT AUTHORITY\SYSTEM… |
CVE-2021-29298 | Medium | 5.3 | 2021-07-30 | Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via craft… |
CVE-2021-37595 | Critical | 9.8 | 2021-07-30 | In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE Fi… |
CVE-2021-37594 | Critical | 9.8 | 2021-07-30 | In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE Fil… |
CVE-2021-36742 | High | 7.8 | 2021-07-29 | A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a loca… |
CVE-2021-34432 | High | 7.5 | 2021-07-27 | In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0. |
CVE-2021-32795 | Medium | 6.5 | 2021-07-26 | ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of S… |
CVE-2021-29770 | Medium | 6.5 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actions due to hazardous i… |
CVE-2021-1097 | High | 7.8 | 2021-07-21 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it improperly validates the length field in a request from a gues… |
CVE-2020-7866 | High | 8.8 | 2021-07-20 | When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation |
CVE-2020-5321 | High | 7.6 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input valida… |