CWE-20 · Improper Input Validation (page 55)
Page 55 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0163 | Medium | 6.5 | 2020-06-11 | In parseSampleAuxiliaryInformationSizes of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remot… |
CVE-2020-0162 | Medium | 6.5 | 2020-06-11 | In parseSampleAuxiliaryInformationOffsets of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to rem… |
CVE-2020-0161 | Medium | 6.5 | 2020-06-11 | In parseChunk of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with n… |
CVE-2020-0160 | High | 8.8 | 2020-06-11 | In setSyncSampleParams of SampleTable.cpp, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service wit… |
CVE-2020-0118 | High | 7.8 | 2020-06-10 | In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of pr… |
CVE-2020-4433 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with in… |
CVE-2020-1286 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerabi… |
CVE-2020-1239 | High | 8.8 | 2020-06-09 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-9855 | High | 7.8 | 2020-06-09 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2020-9829 | Medium | 6.5 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5. Processing a ma… |
CVE-2020-9826 | High | 7.5 | 2020-06-09 | A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A remote attac… |
CVE-2020-9803 | High | 8.8 | 2020-06-09 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, i… |
CVE-2020-9793 | High | 7.8 | 2020-06-09 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, w… |
CVE-2020-9788 | High | 7.8 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.5. A file may be incorrectly rendered to execute… |
CVE-2020-9792 | Medium | 4.6 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A USB device may be… |
CVE-2020-12803 | Medium | 6.5 | 2020-06-08 | ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an exte… |
CVE-2020-13646 | High | 7.8 | 2020-06-05 | In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2020-10068 | Medium | 5.1 | 2020-06-05 | In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issu… |
CVE-2020-12852 | Medium | 6.8 | 2020-06-04 | The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update… |
CVE-2020-13835 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials… |
CVE-2020-13832 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code executio… |
CVE-2020-3257 | High | 8.1 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3238 | High | 8.1 | 2020-06-03 | A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or… |
CVE-2020-3235 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches cou… |
CVE-2020-3230 | High | 7.5 | 2020-06-03 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r… |
CVE-2020-3228 | High | 8.6 | 2020-06-03 | A vulnerability in Security Group Tag Exchange Protocol (SXP) in Cisco IOS Software, Cisco IOS XE Software, and Cisco NX-OS Software could allow an unauthentic… |
CVE-2020-3226 | High | 8.6 | 2020-06-03 | A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2020-3225 | High | 8.6 | 2020-06-03 | Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an u… |
CVE-2020-3221 | High | 8.6 | 2020-06-03 | A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an… |
CVE-2020-3219 | High | 8.8 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrati… |
CVE-2020-3218 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code w… |
CVE-2020-3217 | High | 8.8 | 2020-06-03 | A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Ci… |
CVE-2020-3215 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an aff… |
CVE-2020-3214 | Medium | 6.7 | 2020-06-03 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vu… |
CVE-2020-3206 | Medium | 4.7 | 2020-06-03 | A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IO… |
CVE-2020-3205 | High | 8.8 | 2020-06-03 | A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial IS… |
CVE-2020-3204 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3201 | Medium | 6.0 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3199 | High | 8.8 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3322 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3321 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3319 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3623 | High | 7.8 | 2020-06-02 | kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130 |
CVE-2019-14038 | High | 7.1 | 2020-06-02 | Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapd… |
CVE-2020-13401 | Medium | 6.0 | 2020-06-02 | An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, an… |
CVE-2019-15709 | Medium | 6.5 | 2020-06-01 | An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators… |
CVE-2020-12062 | High | 7.5 | 2020-06-01 | The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user… |
CVE-2020-6868 | Medium | 6.5 | 2020-06-01 | There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The f… |
CVE-2020-13634 | High | 7.8 | 2020-05-29 | In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or… |
CVE-2020-4231 | Medium | 6.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. I… |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-5537 | Critical | 9.8 | 2020-05-25 | Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors. |
CVE-2020-3314 | Medium | 6.1 | 2020-05-22 | A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files… |
CVE-2020-3280 | Critical | 9.8 | 2020-05-22 | A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker t… |
CVE-2020-3272 | High | 7.5 | 2020-05-22 | A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2020-1195 | Medium | 5.9 | 2020-05-21 | An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input, aka 'Microsoft Edge (… |
CVE-2020-1173 | Medium | 6.8 | 2020-05-21 | A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments, aka 'Microsoft Power BI R… |
CVE-2020-1084 | Medium | 5.5 | 2020-05-21 | A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values.An attacker who succes… |
CVE-2020-1081 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Pri… |
CVE-2020-10738 | High | 7.5 | 2020-05-21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible… |
CVE-2020-6485 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2020-7137 | Medium | 6.7 | 2020-05-19 | A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.25.46 or later to re… |
CVE-2020-1695 | High | 7.5 | 2020-05-19 | A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation… |
CVE-2020-4411 | High | 7.1 | 2020-05-19 | The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel mo… |
CVE-2020-10967 | Medium | 5.3 | 2020-05-18 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. |
CVE-2020-13111 | High | 7.5 | 2020-05-16 | NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote at… |
CVE-2020-3810 | Medium | 5.5 | 2020-05-15 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb file… |
CVE-2020-8100 | Critical | 9.0 | 2020-05-15 | Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while s… |
CVE-2020-2011 | High | 7.5 | 2020-05-13 | An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a… |
CVE-2020-1714 | High | 8.8 | 2020-05-13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker… |
CVE-2020-7454 | Critical | 9.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not p… |
CVE-2019-15880 | Critical | 9.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on… |
CVE-2020-12742 | Medium | 6.1 | 2020-05-13 | The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. |
CVE-2020-3341 | High | 7.5 | 2020-05-13 | A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker… |
CVE-2020-3327 | High | 7.5 | 2020-05-13 | A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause… |
CVE-2020-6248 | High | 7.2 | 2020-05-12 | SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP o… |
CVE-2020-10058 | High | 7.8 | 2020-05-11 | Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges… |
CVE-2020-10028 | High | 7.8 | 2020-05-11 | Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. versio… |
CVE-2020-12752 | High | 7.5 | 2020-05-11 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force a… |
CVE-2018-20225 | High | 7.8 | 2020-05-08 | An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a privat… |
CVE-2020-7803 | High | 7.8 | 2020-05-07 | IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGT… |
CVE-2020-10971 | High | 8.8 | 2020-05-07 | An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied comm… |
CVE-2019-19164 | High | 7.8 | 2020-05-07 | dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the a… |
CVE-2020-6651 | High | 8.8 | 2020-05-07 | Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attacker… |
CVE-2020-12669 | High | 8.8 | 2020-05-06 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu paramet… |
CVE-2018-8956 | Medium | 5.3 | 2020-05-06 | ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP se… |
CVE-2020-3309 | High | 7.2 | 2020-05-06 | A vulnerability in Cisco Firepower Device Manager (FDM) On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the under… |
CVE-2020-3307 | Medium | 5.3 | 2020-05-06 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to write arbitrary entries to… |
CVE-2020-3302 | High | 8.1 | 2020-05-06 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to overwrite files on the file… |
CVE-2020-3191 | High | 8.6 | 2020-05-06 | A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-10693 | Medium | 5.3 | 2020-05-06 | A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if… |
CVE-2017-18867 | Medium | 6.8 | 2020-05-05 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6100 before 1.0.0.55, D7800 before V1.0.1.24, R7100LG befor… |
CVE-2020-10622 | High | 7.8 | 2020-05-04 | LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users |
CVE-2020-1732 | Medium | 4.2 | 2020-05-04 | A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads… |
CVE-2019-16011 | High | 7.8 | 2020-04-29 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with roo… |
CVE-2020-8476 | Medium | 5.3 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8475 | Medium | 5.3 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2019-5614 | Critical | 9.8 | 2020-04-29 | In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete pac… |
CVE-2019-15874 | Critical | 9.8 | 2020-04-29 | In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete pac… |