CWE-20 · Improper Input Validation (page 52)
Page 52 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3602 | Medium | 6.3 | 2020-10-08 | A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privilege… |
CVE-2020-3601 | Medium | 4.4 | 2020-10-08 | A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privilege… |
CVE-2020-3568 | Medium | 5.8 | 2020-10-08 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-3567 | Medium | 6.5 | 2020-10-08 | A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remote attacker to cause the CPU utilizatio… |
CVE-2020-25768 | Medium | 5.3 | 2020-10-07 | Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms whic… |
CVE-2020-26597 | High | 7.5 | 2020-10-06 | An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect input validation, leading to a crash. The L… |
CVE-2020-7740 | High | 8.2 | 2020-10-06 | This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator… |
CVE-2020-24807 | High | 7.8 | 2020-10-06 | The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code b… |
CVE-2020-15174 | High | 7.5 | 2020-10-06 | In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as… |
CVE-2020-25643 | High | 7.2 | 2020-10-06 | A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input valid… |
CVE-2020-5986 | Medium | 5.5 | 2020-10-02 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of… |
CVE-2020-5985 | High | 7.1 | 2020-10-02 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering or denial o… |
CVE-2020-15234 | Medium | 6.1 | 2020-10-02 | ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and t… |
CVE-2020-15233 | Medium | 6.1 | 2020-10-02 | ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an… |
CVE-2020-7070 | Medium | 4.3 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec… |
CVE-2020-7069 | Medium | 5.4 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only… |
CVE-2020-15228 | Low | 3.5 | 2020-10-01 | In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a… |
CVE-2020-25626 | Medium | 6.1 | 2020-09-30 | A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to proper… |
CVE-2020-15731 | Low | 3.2 | 2020-09-30 | An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file… |
CVE-2020-4607 | High | 7.8 | 2020-09-29 | IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input val… |
CVE-2020-15210 | Medium | 6.5 | 2020-09-25 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator… |
CVE-2020-15206 | Critical | 9.0 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required k… |
CVE-2020-15203 | High | 7.5 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able t… |
CVE-2020-15201 | Medium | 4.8 | 2020-09-25 | In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In part… |
CVE-2020-15200 | Medium | 5.9 | 2020-09-25 | In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In part… |
CVE-2020-15199 | Medium | 5.9 | 2020-09-25 | In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there i… |
CVE-2020-15197 | Medium | 6.3 | 2020-09-25 | In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In part… |
CVE-2020-15194 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of it… |
CVE-2020-15192 | Medium | 4.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation… |
CVE-2020-15191 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind… |
CVE-2020-15190 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two te… |
CVE-2020-24692 | High | 7.1 | 2020-09-25 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation… |
CVE-2020-24615 | Medium | 5.3 | 2020-09-25 | Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP. |
CVE-2020-24593 | High | 7.2 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper inpu… |
CVE-2020-13387 | High | 7.5 | 2020-09-25 | Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323. |
CVE-2020-12824 | High | 7.5 | 2020-09-25 | Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP. |
CVE-2020-11805 | Critical | 9.8 | 2020-09-25 | Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. |
CVE-2019-7178 | High | 7.2 | 2020-09-25 | Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup. |
CVE-2020-3527 | High | 8.6 | 2020-09-24 | A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerabi… |
CVE-2020-3526 | High | 8.6 | 2020-09-24 | A vulnerability in the Common Open Policy Service (COPS) engine of Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers could allow an unauthentica… |
CVE-2020-3516 | Medium | 4.3 | 2020-09-24 | A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device… |
CVE-2020-3511 | High | 7.4 | 2020-09-24 | A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an… |
CVE-2020-3497 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3494 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3493 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3492 | High | 8.6 | 2020-09-24 | A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers and Cisco AireO… |
CVE-2020-3489 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3488 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3487 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3486 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3479 | Medium | 6.1 | 2020-09-24 | A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco… |
CVE-2020-3477 | Medium | 5.5 | 2020-09-24 | A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash… |
CVE-2020-3475 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3474 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3465 | High | 7.4 | 2020-09-24 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a device to reload. The vulnerability is due to incorrect h… |
CVE-2020-3429 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an una… |
CVE-2020-3428 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthentica… |
CVE-2020-3426 | High | 7.5 | 2020-09-24 | A vulnerability in the implementation of the Low Power, Wide Area (LPWA) subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Ro… |
CVE-2020-3425 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2020-3409 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected… |
CVE-2020-3393 | Medium | 6.0 | 2020-09-24 | A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an… |
CVE-2020-3390 | High | 7.4 | 2020-09-24 | A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisc… |
CVE-2020-3359 | High | 8.6 | 2020-09-24 | A vulnerability in the multicast DNS (mDNS) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated… |
CVE-2020-3141 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2020-6020 | Medium | 6.4 | 2020-09-24 | Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be ma… |
CVE-2020-4324 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID: 17… |
CVE-2020-3133 | High | 7.5 | 2020-09-23 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2020-3130 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying fil… |
CVE-2020-3116 | Medium | 5.5 | 2020-09-23 | A vulnerability in the way Cisco Webex applications process Universal Communications Format (UCF) files could allow an attacker to cause a denial of service (D… |
CVE-2019-1983 | Medium | 5.3 | 2020-09-23 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management… |
CVE-2019-1947 | High | 8.6 | 2020-09-23 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remot… |
CVE-2019-16017 | Medium | 6.8 | 2020-09-23 | A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could al… |
CVE-2019-15974 | Medium | 6.1 | 2020-09-23 | A vulnerability in the web interface of Cisco Managed Services Accelerator (MSX) could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2019-15959 | Medium | 6.6 | 2020-09-23 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-15957 | High | 7.2 | 2020-09-23 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with admi… |
CVE-2019-15289 | High | 7.5 | 2020-09-23 | Multiple vulnerabilities in the video service of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an unauthenticated, remot… |
CVE-2020-4618 | Medium | 4.9 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937. |
CVE-2020-6571 | Medium | 4.3 | 2020-09-21 | Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |
CVE-2020-6567 | Medium | 6.5 | 2020-09-21 | Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navig… |
CVE-2020-15964 | High | 8.8 | 2020-09-21 | Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-25787 | Critical | 9.8 | 2020-09-19 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them. |
CVE-2020-15181 | Critical | 9.3 | 2020-09-18 | The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using… |
CVE-2020-0325 | Medium | 4.4 | 2020-09-18 | In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede… |
CVE-2020-15186 | Low | 3.4 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name… |
CVE-2020-15184 | Low | 3.7 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injecti… |
CVE-2020-0363 | Medium | 6.5 | 2020-09-17 | In libmedia, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution… |
CVE-2020-0362 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0353 | Medium | 6.5 | 2020-09-17 | In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-0351 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution… |
CVE-2020-0333 | Critical | 9.8 | 2020-09-17 | In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. U… |
CVE-2020-0320 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0301 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0287 | Medium | 6.5 | 2020-09-17 | In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-0130 | High | 7.8 | 2020-09-17 | In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with… |
CVE-2020-14338 | Medium | 5.3 | 2020-09-17 | A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use… |
CVE-2020-24377 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3. |
CVE-2020-24376 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3. |
CVE-2020-24374 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in Freebox v5 before 1.5.29. |
CVE-2020-14513 | High | 7.5 | 2020-09-16 | CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. |
CVE-2020-10715 | Medium | 4.3 | 2020-09-16 | A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto th… |