CWE-20 · Improper Input Validation (page 56)
Page 56 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10663 | High | 7.5 | 2020-04-28 | The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability… |
CVE-2020-5565 | Medium | 4.3 | 2020-04-28 | Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's data via the applica… |
CVE-2019-5303 | Medium | 5.3 | 2020-04-27 | There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station… |
CVE-2019-5302 | Medium | 5.3 | 2020-04-27 | There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station… |
CVE-2020-1880 | Medium | 5.5 | 2020-04-27 | Huawei smartphone Lion-AL00C with versions earlier than 10.0.0.205(C00E202R7P2) have a denial of service vulnerability. An attacker crafted specially file to t… |
CVE-2017-18747 | Medium | 6.5 | 2020-04-23 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 befor… |
CVE-2020-4415 | Critical | 9.8 | 2020-04-23 | IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker… |
CVE-2020-12066 | High | 7.5 | 2020-04-22 | CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server. |
CVE-2018-21122 | Medium | 6.5 | 2020-04-22 | Certain NETGEAR devices are affected by denial of service. This affects GS110EMX before 1.0.0.9, GS810EMX before 1.0.0.5, XS512EM before 1.0.0.6, and XS724EM b… |
CVE-2017-18763 | Medium | 6.5 | 2020-04-22 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v… |
CVE-2018-21115 | High | 8.8 | 2020-04-22 | NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers. |
CVE-2017-18778 | Medium | 5.5 | 2020-04-22 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6220 before 1.0.0.28, D6400 before 1.0.0.60, D7000 before 1… |
CVE-2018-21141 | Medium | 4.5 | 2020-04-21 | Certain NETGEAR devices are affected by denial of service. This affects R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0… |
CVE-2018-21140 | Medium | 6.5 | 2020-04-21 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76. |
CVE-2020-11008 | Medium | 4.0 | 2020-04-21 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is simi… |
CVE-2017-18799 | High | 7.5 | 2020-04-21 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6200v2 before 1.0.3.14, R6250 before 1.0.4.8, R6300v2 befor… |
CVE-2017-18798 | Medium | 6.2 | 2020-04-21 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, D7000 before… |
CVE-2017-18803 | Medium | 6.2 | 2020-04-21 | NETGEAR R7800 devices before 1.0.2.30 are affected by incorrect configuration of security settings. |
CVE-2020-1757 | High | 8.1 | 2020-04-21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final… |
CVE-2020-11890 | Medium | 5.3 | 2020-04-21 | An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration. |
CVE-2017-18840 | Medium | 6.2 | 2020-04-20 | Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15… |
CVE-2020-5728 | Medium | 6.1 | 2020-04-17 | OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient… |
CVE-2019-20778 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Backup subsystem does not properly restrict operati… |
CVE-2020-10211 | Critical | 9.8 | 2020-04-17 | A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbit… |
CVE-2020-11007 | Medium | 6.5 | 2020-04-16 | In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart… |
CVE-2020-3653 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon Compute, Snapdragon… |
CVE-2020-3652 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable receive… |
CVE-2020-3262 | High | 7.5 | 2020-04-15 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol handler of Cisco Wireless LAN Controller (WLC) Software could allow… |
CVE-2020-3252 | Medium | 6.5 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3251 | High | 8.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3250 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3249 | High | 7.5 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3248 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3247 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3243 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3240 | High | 7.3 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3239 | High | 8.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3194 | High | 7.8 | 2020-04-15 | A vulnerability in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute a… |
CVE-2020-3162 | High | 7.5 | 2020-04-15 | A vulnerability in the Constrained Application Protocol (CoAP) implementation of Cisco IoT Field Network Director could allow an unauthenticated remote attacke… |
CVE-2020-3161 | Critical | 9.8 | 2020-04-15 | A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of… |
CVE-2019-12520 | High | 7.5 | 2020-04-15 | An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by maki… |
CVE-2020-3954 | Medium | 6.1 | 2020-04-15 | Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. |
CVE-2020-3953 | Medium | 4.8 | 2020-04-15 | Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. |
CVE-2020-11536 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary a… |
CVE-2020-11534 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass pa… |
CVE-2020-0984 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka… |
CVE-2020-0910 | High | 8.4 | 2020-04-15 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2020-2908 | High | 8.2 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2907 | High | 7.5 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-5260 | Critical | 9.3 | 2020-04-14 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses externa… |
CVE-2020-8324 | Medium | 5.0 | 2020-04-14 | A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL… |
CVE-2020-6227 | High | 7.5 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several ser… |
CVE-2020-4151 | Medium | 6.5 | 2020-04-14 | IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. IBM X-Force ID: 174… |
CVE-2020-3126 | Low | 3.0 | 2020-04-13 | vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vu… |
CVE-2020-1633 | High | 7.4 | 2020-04-09 | Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Ne… |
CVE-2020-1619 | Medium | 6.0 | 2020-04-08 | A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine (NG-RE), a… |
CVE-2020-1986 | Medium | 5.5 | 2020-04-08 | Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\… |
CVE-2020-1984 | High | 7.8 | 2020-04-08 | Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root… |
CVE-2018-21078 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) software. The Contacts application allows attackers to originate video calls… |
CVE-2018-21068 | Medium | 6.2 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.0) software. Execution of an application in a locked Secure Folder can occur without a password via… |
CVE-2018-21055 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm models using MSM8996 chipsets) software. A device can be rooted with a custom image to… |
CVE-2018-21092 | Medium | 6.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. A crafted AT command may be sent by the DeviceTest application via an NFC ta… |
CVE-2015-9545 | High | 7.1 | 2020-04-07 | An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of… |
CVE-2015-9544 | High | 7.1 | 2020-04-07 | An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of… |
CVE-2017-18685 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. The InputMethod application can cause a system crash via a mal… |
CVE-2017-18684 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows provider seizure via an application that uses a custom pro… |
CVE-2017-18683 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows Hare Hunting during application installation. The Samsung… |
CVE-2017-18680 | High | 7.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (tablets) software. The lockscreen interface allows Add User actions, leading to a… |
CVE-2017-18679 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. SLocation can cause a system crash via a call to an API that is not implemented. The Sa… |
CVE-2017-18676 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm chipsets) software. There is an RKP kernel protection bypass (in which unwanted memory… |
CVE-2017-18674 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.0) software. The time service (aka Timaservice) allows a kernel panic. The Samsung ID is SVE-2017-85… |
CVE-2017-18673 | Low | 2.4 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can disable the Location service on a locked device, making it impossible f… |
CVE-2017-18667 | Medium | 4.3 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Attackers can prevent users from learning that SMS sto… |
CVE-2017-18648 | Critical | 9.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the lo… |
CVE-2020-7614 | Critical | 9.8 | 2020-04-07 | npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are… |
CVE-2016-11040 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software. There is a Factory Reset Protection (FRP) b… |
CVE-2016-11032 | Medium | 5.3 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. An attacker can disable all Sound functionality by broadcasting an unprotected intent… |
CVE-2016-11031 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. AntService allows a system_server crash and reboot. The Samsun… |
CVE-2016-11053 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL). There is a Factory Reset Protection (FRP) bypass. The S… |
CVE-2016-11052 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed… |
CVE-2016-11048 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software. There is a Factory Reset Protection (FRP) bypass… |
CVE-2016-11046 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software. Because of a misused whitelist, attackers can reach the radi… |
CVE-2020-8147 | Critical | 9.8 | 2020-04-03 | Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or… |
CVE-2019-19095 | Medium | 5.4 | 2020-04-02 | Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing m… |
CVE-2018-13371 | High | 8.8 | 2020-04-02 | An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to… |
CVE-2020-3850 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3849 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3848 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3847 | Critical | 9.8 | 2020-04-01 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory. |
CVE-2020-10204 | High | 7.2 | 2020-04-01 | Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. |
CVE-2020-3905 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3893 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3892 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3884 | Medium | 6.1 | 2020-04-01 | An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary java… |
CVE-2019-14905 | Medium | 5.6 | 2020-03-31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy… |
CVE-2020-4214 | High | 7.5 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied in… |
CVE-2020-4206 | High | 8.8 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused b… |
CVE-2020-10374 | Critical | 9.8 | 2020-03-30 | A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or th… |
CVE-2020-5255 | Low | 2.6 | 2020-03-30 | In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format… |
CVE-2020-10885 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |