CWE-20 · Improper Input Validation (page 55)
Page 55 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27828 | High | 7.8 | 2020-12-11 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds writ… |
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |
CVE-2020-26270 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using… |
CVE-2020-27614 | High | 7.8 | 2020-12-09 | AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege… |
CVE-2020-9977 | Medium | 5.5 | 2020-12-08 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2020-5680 | High | 7.5 | 2020-12-03 | Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unsp… |
CVE-2020-9115 | High | 7.2 | 2020-12-01 | ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker w… |
CVE-2020-16850 | High | 7.5 | 2020-11-30 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the netwo… |
CVE-2020-27253 | High | 7.5 | 2020-11-26 | A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacke… |
CVE-2020-26243 | High | 7.5 | 2020-11-25 | Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory… |
CVE-2020-13942 | Critical | 9.8 | 2020-11-24 | It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was f… |
CVE-2020-26890 | High | 7.5 | 2020-11-24 | Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attac… |
CVE-2018-16723 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16722 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16721 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16720 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16719 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2020-12351 | High | 8.8 | 2020-11-23 | Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. |
CVE-2018-20804 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Serve… |
CVE-2020-7925 | High | 7.5 | 2020-11-23 | Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially craf… |
CVE-2020-14258 | High | 7.5 | 2020-11-21 | HCL Notes is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exp… |
CVE-2020-14234 | High | 7.5 | 2020-11-21 | HCL Domino is susceptible to a Denial of Service vulnerability due to improper validation of user-supplied input, potentially giving an attacker the ability to… |
CVE-2020-14230 | High | 7.5 | 2020-11-21 | HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could ex… |
CVE-2020-7842 | Medium | 6.4 | 2020-11-20 | Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (usin… |
CVE-2020-6879 | Low | 3.5 | 2020-11-19 | Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of t… |
CVE-2020-3471 | Medium | 6.5 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to maintain bidirectional audio despite… |
CVE-2020-3470 | Critical | 9.8 | 2020-11-18 | Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitr… |
CVE-2020-3441 | Medium | 5.3 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the… |
CVE-2020-7841 | High | 8.8 | 2020-11-17 | Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http… |
CVE-2020-27131 | High | 8.1 | 2020-11-17 | Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute… |
CVE-2020-27125 | High | 7.4 | 2020-11-17 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerabil… |
CVE-2020-28648 | High | 8.8 | 2020-11-16 | Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code. |
CVE-2020-25151 | High | 7.5 | 2020-11-13 | The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50 (all versions). |
CVE-2020-9127 | Medium | 6.7 | 2020-11-13 | Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious co… |
CVE-2020-8669 | Medium | 6.5 | 2020-11-12 | Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information di… |
CVE-2020-12349 | Medium | 6.5 | 2020-11-12 | Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information di… |
CVE-2020-12347 | High | 8.8 | 2020-11-12 | Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable escalation of… |
CVE-2020-12323 | Medium | 6.7 | 2020-11-12 | Improper input validation in the Intel(R) ADAS IE before version ADAS_IE_1.0.766 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2020-0572 | Medium | 6.7 | 2020-11-12 | Improper input validation in the firmware for Intel(R) Server Board S2600ST and S2600WF families may allow a privileged user to potentially enable escalation o… |
CVE-2020-8756 | Medium | 6.7 | 2020-11-12 | Improper input validation in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potent… |
CVE-2020-7472 | Critical | 9.8 | 2020-11-12 | An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and… |
CVE-2020-12322 | Medium | 6.5 | 2020-11-12 | Improper input validation in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable denial… |
CVE-2020-12314 | Medium | 6.5 | 2020-11-12 | Improper input validation in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial o… |
CVE-2020-0590 | High | 7.8 | 2020-11-12 | Improper input validation in BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2020-11201 | High | 7.8 | 2020-11-12 | Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2020-2000 | High | 7.2 | 2020-11-12 | An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system p… |
CVE-2020-16127 | Low | 2.8 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations… |
CVE-2020-26817 | High | 7.8 | 2020-11-10 | SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the app… |
CVE-2020-0442 | High | 7.5 | 2020-11-10 | In Message and toBundle of Notification.java, there is a possible UI slowdown or crash due to improper input validation. This could lead to remote denial of se… |
CVE-2020-8268 | High | 7.5 | 2020-11-09 | Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object… |
CVE-2020-28349 | Medium | 6.5 | 2020-11-09 | An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequ… |
CVE-2020-3556 | High | 7.3 | 2020-11-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacke… |
CVE-2020-3444 | High | 7.5 | 2020-11-06 | A vulnerability in the packet filtering features of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters… |
CVE-2020-5643 | Medium | 6.5 | 2020-11-06 | Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via un… |
CVE-2020-24432 | Medium | 6.7 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175… |
CVE-2020-24427 | Low | 3.3 | 2020-11-05 | Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnera… |
CVE-2020-15983 | High | 7.8 | 2020-11-03 | Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a craft… |
CVE-2020-15978 | High | 8.8 | 2020-11-03 | Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2020-15977 | Medium | 6.5 | 2020-11-03 | Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2020-28031 | Medium | 4.3 | 2020-11-02 | eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users. |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2020-3703 | Critical | 9.8 | 2020-11-02 | u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is… |
CVE-2020-11156 | High | 8.1 | 2020-11-02 | u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto, Snapdragon… |
CVE-2020-11141 | High | 8.1 | 2020-11-02 | u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.' in Snapdragon A… |
CVE-2018-19949 | Critical | 9.8 | 2020-10-28 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT… |
CVE-2020-8255 | Medium | 4.9 | 2020-10-28 | A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerabilit… |
CVE-2019-8857 | Low | 3.3 | 2020-10-27 | The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video da… |
CVE-2019-8853 | Medium | 5.5 | 2020-10-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Upd… |
CVE-2019-8664 | Medium | 6.5 | 2020-10-27 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted messag… |
CVE-2020-25765 | Critical | 9.8 | 2020-10-27 | Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1… |
CVE-2019-8774 | Medium | 5.5 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a mali… |
CVE-2019-8737 | Medium | 6.5 | 2020-10-27 | A denial of service issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update… |
CVE-2019-8736 | Medium | 6.5 | 2020-10-27 | An input validation issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security U… |
CVE-2019-8668 | Medium | 5.5 | 2020-10-27 | A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. Processing a maliciously crafted ima… |
CVE-2019-8640 | High | 7.5 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-0… |
CVE-2019-8633 | High | 7.5 | 2020-10-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security… |
CVE-2019-8592 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, tvOS 12.3, watchOS 5.2.1, tvOS 13, macOS C… |
CVE-2019-8579 | High | 7.8 | 2020-10-27 | An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Secur… |
CVE-2019-8573 | High | 7.5 | 2020-10-27 | An input validation issue was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Secu… |
CVE-2019-6238 | High | 7.8 | 2020-10-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Mojave 10.1… |
CVE-2019-17006 | Critical | 9.8 | 2020-10-22 | In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library… |
CVE-2020-9906 | Critical | 9.1 | 2020-10-22 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8… |
CVE-2020-9853 | High | 7.8 | 2020-10-22 | A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to determi… |
CVE-2020-3898 | High | 7.8 | 2020-10-22 | A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated pr… |
CVE-2020-3577 | High | 7.4 | 2020-10-21 | A vulnerability in the ingress packet processing path of Cisco Firepower Threat Defense (FTD) Software for interfaces that are configured either as Inline Pair… |
CVE-2020-3571 | High | 8.6 | 2020-10-21 | A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 4110 appliances could allow an unaut… |
CVE-2020-3317 | High | 7.5 | 2020-10-21 | A vulnerability in the ssl_inspection component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to crash Snort… |
CVE-2020-3304 | High | 8.6 | 2020-10-21 | A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthentic… |
CVE-2020-6366 | Medium | 6.5 | 2020-10-20 | SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privi… |
CVE-2020-15256 | High | 7.7 | 2020-10-19 | A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInherit… |
CVE-2020-24388 | High | 7.5 | 2020-10-19 | An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a messag… |
CVE-2020-11496 | Medium | 6.7 | 2020-10-19 | Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the valida… |
CVE-2020-24649 | Critical | 9.8 | 2020-10-19 | A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s… |
CVE-2020-24647 | Critical | 9.8 | 2020-10-19 | A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior t… |
CVE-2020-1167 | High | 7.8 | 2020-10-16 | <p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited… |
CVE-2020-16968 | High | 7.8 | 2020-10-16 | <p>A remote code execution vulnerability exists when the Windows Camera Codec Pack improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2020-16891 | High | 8.8 | 2020-10-16 | <p>A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest op… |
CVE-2020-1682 | Medium | 5.5 | 2020-10-16 | An input validation vulnerability exists in Juniper Networks Junos OS, allowing an attacker to crash the srxpfe process, causing a Denial of Service (DoS) thro… |
CVE-2020-1679 | High | 7.5 | 2020-10-16 | On Juniper Networks PTX and QFX Series devices with packet sampling configured using tunnel-observation mpls-over-udp, sampling of a malformed packet can cause… |
CVE-2020-1677 | High | 7.2 | 2020-10-16 | When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle child elements in SAML responses, allowing a remote attacker to mo… |