CWE-20 · Improper Input Validation (page 50)
Page 50 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1301 | Critical | 9.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against an affected device. For more infor… |
CVE-2021-1299 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1298 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1286 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator… |
CVE-2021-1279 | High | 8.6 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affecte… |
CVE-2021-1263 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1262 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1261 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1260 | High | 7.8 | 2021-01-20 | Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device, which… |
CVE-2021-1253 | Medium | 6.5 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator… |
CVE-2021-0208 | High | 8.8 | 2021-01-15 | An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSV… |
CVE-2021-23835 | Medium | 4.9 | 2021-01-15 | An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP request body parameter f… |
CVE-2021-1150 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1149 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1148 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1147 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2021-1146 | High | 7.2 | 2021-01-13 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2020-9139 | Critical | 9.1 | 2021-01-13 | There is a improper input validation vulnerability in some Huawei Smartphone.Successful exploit of this vulnerability can cause memory access errors and denial… |
CVE-2021-3028 | Critical | 9.8 | 2021-01-13 | git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution. |
CVE-2021-21606 | Medium | 4.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an att… |
CVE-2021-21464 | Medium | 4.3 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-0322 | Medium | 5.0 | 2021-01-11 | In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation. This could lead to local informa… |
CVE-2021-0313 | High | 7.5 | 2021-01-11 | In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial… |
CVE-2020-0471 | Critical | 9.8 | 2021-01-11 | In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input vali… |
CVE-2020-16040 | Medium | 6.5 | 2021-01-08 | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-16015 | High | 8.8 | 2021-01-08 | Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2021-1066 | Medium | 5.5 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumption of resources, w… |
CVE-2021-1065 | High | 7.1 | 2021-01-08 | NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data or denial of service… |
CVE-2021-1060 | High | 7.1 | 2021-01-08 | NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, which may lead to tamp… |
CVE-2020-4667 | Medium | 4.3 | 2021-01-08 | IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation… |
CVE-2021-1053 | Medium | 5.5 | 2021-01-08 | NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IO… |
CVE-2020-6656 | Medium | 5.8 | 2021-01-07 | Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execu… |
CVE-2020-6655 | Medium | 5.8 | 2021-01-07 | The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malic… |
CVE-2020-4896 | Medium | 6.5 | 2021-01-07 | IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. I… |
CVE-2020-36175 | Medium | 5.3 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. |
CVE-2020-27844 | High | 7.8 | 2021-01-05 | A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conver… |
CVE-2020-25275 | High | 7.5 | 2021-01-04 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices fo… |
CVE-2020-35493 | Medium | 5.5 | 2021-01-04 | A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-… |
CVE-2018-25002 | High | 8.8 | 2021-01-01 | uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covere… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2016-9026 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. |
CVE-2016-9025 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. |
CVE-2016-9023 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. |
CVE-2016-9022 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. |
CVE-2016-9021 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. |
CVE-2020-26291 | Medium | 6.5 | 2020-12-31 | URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) charac… |
CVE-2020-35789 | High | 8.8 | 2020-12-30 | NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user. |
CVE-2020-35616 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations. |
CVE-2020-14273 | High | 7.5 | 2020-12-28 | HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker cou… |
CVE-2020-9137 | Medium | 6.7 | 2020-12-24 | There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. Due to insufficient… |
CVE-2020-27727 | Medium | 4.9 | 2020-12-24 | On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iApps… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2020-27338 | Medium | 5.9 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows an unauthenticated remote attacker to ca… |
CVE-2020-27337 | High | 7.3 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attacker to cause an Ou… |
CVE-2020-27336 | Low | 3.7 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote… |
CVE-2020-24679 | High | 7.5 | 2020-12-22 | A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbi… |
CVE-2020-14231 | High | 8.8 | 2020-12-22 | A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a… |
CVE-2019-11781 | High | 8.8 | 2020-12-22 | Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims… |
CVE-2018-15632 | Critical | 9.1 | 2020-12-22 | Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initia… |
CVE-2020-35623 | High | 7.5 | 2020-12-21 | An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial… |
CVE-2020-3999 | Medium | 6.5 | 2020-12-21 | VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x pri… |
CVE-2020-27687 | High | 8.8 | 2020-12-18 | ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emai… |
CVE-2020-27154 | High | 8.8 | 2020-12-18 | The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user in… |
CVE-2020-25611 | Medium | 6.1 | 2020-12-18 | The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input va… |
CVE-2020-25608 | High | 7.2 | 2020-12-18 | The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. |
CVE-2020-25606 | Medium | 6.1 | 2020-12-18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, a… |
CVE-2020-7838 | High | 8.8 | 2020-12-18 | A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code whe… |
CVE-2020-12521 | Medium | 6.5 | 2020-12-17 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An… |
CVE-2020-15293 | Medium | 6.1 | 2020-12-17 | Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation m… |
CVE-2020-15292 | Medium | 5.5 | 2020-12-17 | Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree… |
CVE-2020-5682 | High | 7.5 | 2020-12-16 | Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI… |
CVE-2020-25759 | High | 8.8 | 2020-12-15 | An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacke… |
CVE-2020-25757 | High | 8.8 | 2020-12-15 | A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulti… |
CVE-2020-25195 | High | 7.5 | 2020-12-15 | The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input fro… |
CVE-2020-27029 | Medium | 6.5 | 2020-12-15 | In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0493 | Medium | 5.5 | 2020-12-15 | In CPDF_SampledFunc::v_Call of cpdf_sampledfunc.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local informat… |
CVE-2020-0368 | Low | 3.3 | 2020-12-15 | In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This could lead to local information disclosu… |
CVE-2020-17444 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't… |
CVE-2020-17439 | High | 8.3 | 2020-12-11 | An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DN… |
CVE-2020-15375 | Medium | 6.7 | 2020-12-11 | Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line int… |
CVE-2020-4633 | High | 8.8 | 2020-12-11 | IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation. |
CVE-2020-27828 | High | 7.8 | 2020-12-11 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds writ… |
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |
CVE-2020-26270 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using… |
CVE-2020-27614 | High | 7.8 | 2020-12-09 | AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege… |
CVE-2020-9977 | Medium | 5.5 | 2020-12-08 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2020-5680 | High | 7.5 | 2020-12-03 | Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unsp… |
CVE-2020-9115 | High | 7.2 | 2020-12-01 | ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker w… |
CVE-2020-16850 | High | 7.5 | 2020-11-30 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the netwo… |
CVE-2020-27253 | High | 7.5 | 2020-11-26 | A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacke… |
CVE-2020-26243 | High | 7.5 | 2020-11-25 | Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory… |
CVE-2020-13942 | Critical | 9.8 | 2020-11-24 | It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was f… |
CVE-2020-26890 | High | 7.5 | 2020-11-24 | Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attac… |
CVE-2018-16723 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16722 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16721 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16720 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16719 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2020-12351 | High | 8.8 | 2020-11-23 | Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. |
CVE-2018-20804 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Serve… |