CWE-20 · Improper Input Validation (page 57)
Page 57 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0325 | Medium | 4.4 | 2020-09-18 | In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede… |
CVE-2020-15186 | Low | 3.4 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name… |
CVE-2020-15184 | Low | 3.7 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injecti… |
CVE-2020-0363 | Medium | 6.5 | 2020-09-17 | In libmedia, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution… |
CVE-2020-0362 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0353 | Medium | 6.5 | 2020-09-17 | In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-0351 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution… |
CVE-2020-0333 | Critical | 9.8 | 2020-09-17 | In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. U… |
CVE-2020-0320 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0301 | Medium | 6.5 | 2020-09-17 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-0287 | Medium | 6.5 | 2020-09-17 | In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-0130 | High | 7.8 | 2020-09-17 | In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with… |
CVE-2020-14338 | Medium | 5.3 | 2020-09-17 | A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use… |
CVE-2020-24377 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3. |
CVE-2020-24376 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3. |
CVE-2020-24374 | Critical | 9.6 | 2020-09-16 | A DNS rebinding vulnerability in Freebox v5 before 1.5.29. |
CVE-2020-14513 | High | 7.5 | 2020-09-16 | CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. |
CVE-2020-10715 | Medium | 4.3 | 2020-09-16 | A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto th… |
CVE-2020-25614 | Critical | 9.8 | 2020-09-16 | xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlqu… |
CVE-2020-16099 | Medium | 4.3 | 2020-09-15 | In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like reporting cause client… |
CVE-2020-13317 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a… |
CVE-2020-1044 | Medium | 4.3 | 2020-09-11 | <p>A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports… |
CVE-2020-0904 | Medium | 6.5 | 2020-09-11 | <p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest o… |
CVE-2020-9239 | Medium | 5.5 | 2020-09-11 | Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than… |
CVE-2020-16216 | Medium | 6.5 | 2020-09-11 | In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior, the product rece… |
CVE-2020-15170 | High | 7.0 | 2020-09-10 | apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there a… |
CVE-2020-15168 | Low | 2.6 | 2020-09-10 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the l… |
CVE-2020-9743 | Medium | 5.3 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the… |
CVE-2020-24074 | Critical | 9.8 | 2020-09-09 | The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow. |
CVE-2020-6348 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6344 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6338 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RH file received from untrusted sources which results in crashing of the applic… |
CVE-2020-6334 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6333 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6332 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-6314 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-3617 | High | 7.1 | 2020-09-09 | u'Buffer over-read Issue in Q6 testbus framework due to diag packet length is not completely validated before accessing the field and leads to Information disc… |
CVE-2020-3648 | High | 7.8 | 2020-09-08 | u'Possible out of bound write in DSP driver code due to lack of check of data received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I… |
CVE-2020-3621 | Medium | 5.5 | 2020-09-08 | u'Lack of check to ensure that the TX read index & RX write index that are read from shared memory are less than the FIFO size results into memory corruption a… |
CVE-2020-11118 | High | 7.5 | 2020-09-08 | u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2019-14074 | High | 7.8 | 2020-09-08 | u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2020-15709 | Medium | 5.5 | 2020-09-05 | Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to… |
CVE-2020-3546 | Medium | 5.3 | 2020-09-04 | A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-3542 | Medium | 5.3 | 2020-09-04 | A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting passwo… |
CVE-2020-3498 | Medium | 6.5 | 2020-09-04 | A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to imp… |
CVE-2020-3495 | Critical | 9.9 | 2020-09-04 | A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper valid… |
CVE-2020-3478 | High | 8.1 | 2020-09-04 | A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain file… |
CVE-2020-3453 | Medium | 4.7 | 2020-09-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with… |
CVE-2020-3451 | Medium | 4.7 | 2020-09-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with… |
CVE-2020-24940 | High | 7.5 | 2020-09-04 | An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names a… |
CVE-2020-1890 | High | 7.5 | 2020-09-03 | A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticke… |
CVE-2020-9235 | Medium | 5.5 | 2020-09-03 | Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E… |
CVE-2020-7830 | High | 7.8 | 2020-09-02 | RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in dow… |
CVE-2020-5778 | High | 7.5 | 2020-09-02 | A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to d… |
CVE-2020-4693 | Critical | 9.8 | 2020-09-02 | IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caus… |
CVE-2012-3338 | Medium | 5.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new use… |
CVE-2020-15704 | Medium | 5.5 | 2020-09-01 | The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could ex… |
CVE-2020-25063 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. An application crash can occur because of incorrect application… |
CVE-2020-25059 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A service crash may occur because of incorrect input validation… |
CVE-2020-7526 | High | 8.8 | 2020-08-31 | Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code execution when a scri… |
CVE-2020-13465 | Medium | 6.8 | 2020-08-31 | The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via the debug interfac… |
CVE-2020-13594 | Medium | 6.5 | 2020-08-31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map fi… |
CVE-2020-4559 | High | 7.5 | 2020-08-28 | IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613. |
CVE-2019-4533 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589. |
CVE-2020-3454 | High | 7.2 | 2020-08-27 | A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be execu… |
CVE-2020-3398 | High | 8.6 | 2020-08-27 | A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacke… |
CVE-2020-3397 | High | 8.6 | 2020-08-27 | A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacke… |
CVE-2020-3521 | Medium | 5.3 | 2020-08-26 | A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct directory… |
CVE-2020-3519 | High | 8.1 | 2020-08-26 | A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a p… |
CVE-2020-3507 | High | 8.8 | 2020-08-26 | Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adj… |
CVE-2020-3506 | High | 8.8 | 2020-08-26 | Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adj… |
CVE-2020-3496 | Medium | 5.3 | 2020-08-26 | A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to caus… |
CVE-2019-14904 | High | 7.3 | 2020-08-26 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checke… |
CVE-2020-17393 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2019-11857 | Critical | 9.1 | 2020-08-21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. |
CVE-2020-16237 | Low | 2.1 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required… |
CVE-2020-24359 | High | 7.5 | 2020-08-20 | HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was… |
CVE-2020-4548 | Low | 2.7 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypass the user interface and send requests t… |
CVE-2020-10289 | High | 8.8 | 2020-08-20 | Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an act… |
CVE-2020-3502 | Medium | 4.1 | 2020-08-17 | Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted informati… |
CVE-2020-3501 | Medium | 4.1 | 2020-08-17 | Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted informati… |
CVE-2020-3435 | Medium | 5.5 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-3434 | Medium | 5.5 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-3363 | High | 8.6 | 2020-08-17 | A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to caus… |
CVE-2020-13941 | High | 8.8 | 2020-08-17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guid… |
CVE-2020-15694 | High | 7.5 | 2020-08-14 | In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any… |
CVE-2020-8688 | High | 7.5 | 2020-08-13 | Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network… |
CVE-2020-12299 | High | 8.2 | 2020-08-13 | Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable es… |
CVE-2020-0555 | High | 7.8 | 2020-08-13 | Improper input validation for some Intel(R) Wireless Bluetooth(R) products may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2020-8742 | Medium | 6.7 | 2020-08-13 | Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2020-8721 | High | 8.2 | 2020-08-13 | Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially en… |
CVE-2020-8717 | Medium | 5.5 | 2020-08-13 | Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user t… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-17479 | Critical | 9.8 | 2020-08-10 | jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array. |
CVE-2020-16227 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated… |
CVE-2020-16215 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-7459 | Medium | 6.8 | 2020-08-06 | In FreeBSD 12.1-STABLE before r362166, 12.1-RELEASE before p8, 11.4-STABLE before r362167, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, missing length… |
CVE-2020-15112 | Medium | 6.5 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This c… |
CVE-2020-15106 | Medium | 6.5 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file… |
CVE-2020-8607 | Medium | 6.7 | 2020-08-05 | An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an… |