CWE-20 · Improper Input Validation (page 54)
Page 54 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9255 | Medium | 5.5 | 2020-07-17 | Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability. Certain service in the system does not s… |
CVE-2020-9254 | High | 7.8 | 2020-07-17 | HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 1… |
CVE-2020-7818 | High | 7.8 | 2020-07-17 | DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Att… |
CVE-2020-1644 | High | 7.5 | 2020-07-17 | On Juniper Networks Junos OS and Junos OS Evolved devices, the receipt of a specific BGP UPDATE packet causes an internal counter to be incremented incorrectly… |
CVE-2020-1640 | High | 7.5 | 2020-07-17 | An improper use of a validation framework when processing incoming genuine BGP packets within Juniper Networks RPD (routing protocols process) daemon allows an… |
CVE-2020-5131 | High | 7.8 | 2020-07-17 | SonicWall NetExtender Windows client vulnerable to arbitrary file write vulnerability, this allows attacker to overwrite a DLL and execute code with the same p… |
CVE-2020-5130 | Medium | 5.3 | 2020-07-17 | SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the request. This vulnerabi… |
CVE-2020-3387 | High | 8.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The… |
CVE-2020-3379 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operati… |
CVE-2020-3370 | Medium | 5.8 | 2020-07-16 | A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to bypass URL filtering o… |
CVE-2020-3358 | High | 8.6 | 2020-07-16 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause… |
CVE-2020-3357 | Critical | 9.8 | 2020-07-16 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow… |
CVE-2020-3345 | Medium | 4.3 | 2020-07-16 | A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web pa… |
CVE-2020-3323 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote… |
CVE-2020-14503 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker… |
CVE-2020-1355 | High | 7.8 | 2020-07-14 | A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploited the vulnerabili… |
CVE-2020-1350 | Critical | 10.0 | 2020-07-14 | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C… |
CVE-2020-1043 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1042 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1041 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1040 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1036 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1032 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1025 | Critical | 9.8 | 2020-07-14 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An atta… |
CVE-2020-7588 | Medium | 5.3 | 2020-07-14 | A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Executi… |
CVE-2020-13753 | Critical | 10.0 | 2020-07-14 | The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER coul… |
CVE-2020-8195 | Medium | 6.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-8187 | High | 7.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service… |
CVE-2020-9258 | Medium | 5.5 | 2020-07-10 | HUAWEI P30 smartphone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper input verification vulnerability. An attribution in a module is not… |
CVE-2020-7814 | High | 7.8 | 2020-07-10 | RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file ext… |
CVE-2019-19417 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19416 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19415 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2020-15584 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper imag… |
CVE-2020-15543 | Critical | 9.8 | 2020-07-05 | SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path. |
CVE-2020-15503 | High | 7.5 | 2020-07-02 | LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For… |
CVE-2020-9497 | Medium | 4.4 | 2020-07-02 | Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compro… |
CVE-2020-7821 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the… |
CVE-2020-7820 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the a… |
CVE-2020-5238 | Medium | 6.5 | 2020-07-01 | The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown tab… |
CVE-2020-6261 | Medium | 5.3 | 2020-07-01 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The r… |
CVE-2020-5970 | High | 7.1 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of… |
CVE-2020-14957 | High | 7.8 | 2020-06-30 | In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2020-14956 | High | 7.8 | 2020-06-30 | In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2019-19163 | High | 7.5 | 2020-06-30 | A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code, because of a using the old… |
CVE-2020-3767 | Medium | 6.5 | 2020-06-26 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application… |
CVE-2020-14955 | Medium | 5.5 | 2020-06-26 | In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2020-12033 | High | 8.8 | 2020-06-23 | In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which co… |
CVE-2020-14939 | High | 7.8 | 2020-06-23 | An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can b… |
CVE-2020-1727 | Medium | 6.4 | 2020-06-22 | A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wid… |
CVE-2019-14894 | High | 8.0 | 2020-06-22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch… |
CVE-2020-8102 | High | 8.8 | 2020-06-22 | Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to r… |
CVE-2020-3676 | High | 7.8 | 2020-06-22 | Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Sna… |
CVE-2019-14047 | High | 7.8 | 2020-06-22 | While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon A… |
CVE-2019-10626 | Medium | 5.5 | 2020-06-22 | Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compu… |
CVE-2016-11067 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. |
CVE-2017-18890 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an… |
CVE-2017-18889 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash comma… |
CVE-2018-21264 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response. |
CVE-2017-18873 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misf… |
CVE-2020-8184 | High | 7.5 | 2020-06-19 | A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker… |
CVE-2020-13961 | Medium | 6.5 | 2020-06-19 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any s… |
CVE-2018-21262 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text. |
CVE-2018-21259 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malform… |
CVE-2019-20870 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. |
CVE-2019-20868 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. |
CVE-2020-14459 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. |
CVE-2019-20848 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies. |
CVE-2020-3368 | Medium | 5.8 | 2020-06-18 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-3263 | High | 7.5 | 2020-06-18 | A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vul… |
CVE-2020-3244 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Enhanced Charging Service (ECS) functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remo… |
CVE-2020-7504 | Medium | 5.3 | 2020-06-16 | A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to disable the webser… |
CVE-2020-8543 | High | 7.5 | 2020-06-16 | OX App Suite through 7.10.3 has Improper Input Validation. |
CVE-2020-12001 | Critical | 9.8 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-11999 | High | 8.1 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-9075 | Medium | 6.5 | 2020-06-15 | Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerab… |
CVE-2020-1825 | Medium | 6.5 | 2020-06-15 | FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attacker… |
CVE-2020-0596 | High | 7.5 | 2020-06-15 | Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthentic… |
CVE-2020-0538 | High | 7.5 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0537 | Medium | 4.9 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user to potentially enab… |
CVE-2020-0536 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE version… |
CVE-2020-0535 | Medium | 5.3 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable infor… |
CVE-2020-0534 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to pot… |
CVE-2020-0532 | High | 7.1 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0531 | Medium | 6.5 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentially enable informa… |
CVE-2020-13170 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary d… |
CVE-2020-0207 | Medium | 6.5 | 2020-06-11 | In next_marker of jdmarker.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no… |
CVE-2020-0206 | Medium | 5.5 | 2020-06-11 | In the settings app, there is a possible app crash due to improper input validation. This could lead to local denial of service of the Settings app with User e… |
CVE-2020-0196 | Medium | 6.5 | 2020-06-11 | In RegisterNotificationResponse::GetEvent of register_notification_packet.cc, there is a possible abort due to improper input validation. This could lead to re… |
CVE-2020-0192 | Medium | 6.5 | 2020-06-11 | In ih264d_decode_slice_thread of ih264d_thread_parse_decode.c, there is a possible out of bounds read due to improper input validation. This could lead to remo… |
CVE-2020-0179 | High | 7.8 | 2020-06-11 | In doSendObjectInfo of MtpServer.cpp, there is a possible path traversal attack due to insufficient input validation. This could lead to local escalation of pr… |
CVE-2020-0176 | High | 7.5 | 2020-06-11 | In avdt_msg_prs_rej of avdt_msg.cc, there is a possible out-of-bounds read due to improper input validation. This could lead to remote information disclosure w… |
CVE-2020-0175 | Medium | 6.5 | 2020-06-11 | In XMF_ReadNode of eas_xmf.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no addit… |
CVE-2020-0174 | Medium | 6.5 | 2020-06-11 | In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0173 | Medium | 6.5 | 2020-06-11 | In Parse_lins of eas_mdls.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additi… |
CVE-2020-0172 | Medium | 6.5 | 2020-06-11 | In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional… |
CVE-2020-0171 | Medium | 6.5 | 2020-06-11 | In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0170 | Medium | 6.5 | 2020-06-11 | In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-0169 | Medium | 6.5 | 2020-06-11 | In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-0166 | High | 7.8 | 2020-06-11 | In multiple functions of URI.java, there is a possible escalation of privilege due to missing validation in the parceling of URI information. This could lead t… |