CWE-20 · Improper Input Validation (page 57)
Page 57 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2168 | High | 8.8 | 2020-03-25 | Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rem… |
CVE-2020-2167 | High | 8.8 | 2020-03-25 | Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote… |
CVE-2020-2166 | High | 8.8 | 2020-03-25 | Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote c… |
CVE-2020-5555 | Critical | 9.1 | 2020-03-25 | Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via u… |
CVE-2019-4001 | High | 7.8 | 2020-03-24 | Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code. |
CVE-2020-10837 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary c… |
CVE-2020-1747 | Critical | 9.8 | 2020-03-24 | A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted… |
CVE-2020-6425 | Medium | 5.4 | 2020-03-23 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2018-20335 | High | 7.5 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI. |
CVE-2020-10648 | High | 7.8 | 2020-03-19 | Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a s… |
CVE-2019-20485 | Medium | 5.7 | 2020-03-19 | qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of… |
CVE-2020-8787 | High | 7.5 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. |
CVE-2017-12842 | High | 7.5 | 2020-03-16 | Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did… |
CVE-2020-10240 | Medium | 5.3 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or ema… |
CVE-2019-19942 | High | 7.5 | 2020-03-16 | Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02… |
CVE-2019-6696 | Medium | 6.1 | 2020-03-15 | An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redir… |
CVE-2019-2216 | High | 7.3 | 2020-03-15 | In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a local escalation of privilege because… |
CVE-2020-10567 | Critical | 9.8 | 2020-03-14 | An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validati… |
CVE-2020-0567 | Medium | 5.5 | 2020-03-12 | Improper input validation in Intel(R) Graphics Drivers before version 26.20.100.7212 may allow an authenticated user to enable denial of service via local acce… |
CVE-2020-0526 | Medium | 6.7 | 2020-03-12 | Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access. The list of… |
CVE-2018-19516 | Medium | 5.3 | 2020-03-12 | messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRES… |
CVE-2020-0808 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists in the way the Provisioning Runtime validates certain file operations, aka 'Provisioning Runtime Elevation of Pr… |
CVE-2020-7253 | Medium | 5.7 | 2020-03-12 | Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protect… |
CVE-2020-5203 | Critical | 9.8 | 2020-03-11 | In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_PO… |
CVE-2020-6202 | High | 7.2 | 2020-03-10 | SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP dat… |
CVE-2020-0050 | Medium | 6.7 | 2020-03-10 | In nfa_hciu_send_msg of nfa_hci_utils.cc, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of priv… |
CVE-2020-0041 | High | 7.8 | 2020-03-10 | In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege w… |
CVE-2019-7589 | Critical | 9.8 | 2020-03-10 | A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the ser… |
CVE-2019-19298 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < V5.0.2). The stream… |
CVE-2019-19279 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versions). Specially craf… |
CVE-2020-10255 | Critical | 9.0 | 2020-03-10 | Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attacks known as Target… |
CVE-2019-12433 | Medium | 5.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow c… |
CVE-2020-10236 | Medium | 6.1 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writabl… |
CVE-2019-14082 | Critical | 9.1 | 2020-03-05 | Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer Electronics Connectiv… |
CVE-2019-10577 | Critical | 9.1 | 2020-03-05 | Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to denial of service in Snapdragon Auto, Sn… |
CVE-2019-10552 | Critical | 9.1 | 2020-03-05 | Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cmd in Snapdragon Auto, Snapdra… |
CVE-2020-10101 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is… |
CVE-2020-3164 | Medium | 5.3 | 2020-03-04 | A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco… |
CVE-2020-3128 | High | 7.8 | 2020-03-04 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2020-3127 | High | 7.8 | 2020-03-04 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2020-5403 | High | 7.5 | 2020-03-03 | Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing… |
CVE-2020-6797 | Medium | 4.3 | 2020-03-02 | By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is re… |
CVE-2020-8132 | Critical | 9.8 | 2020-02-28 | Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrust… |
CVE-2020-9430 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c b… |
CVE-2020-3860 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, watchOS 6.1.2. An application may… |
CVE-2020-3856 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3… |
CVE-2020-3846 | High | 8.8 | 2020-02-27 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchO… |
CVE-2020-3839 | Medium | 5.5 | 2020-02-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted… |
CVE-2020-3172 | High | 8.8 | 2020-02-26 | A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ex… |
CVE-2020-3170 | Medium | 5.3 | 2020-02-26 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2020-3166 | Medium | 6.7 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating sys… |
CVE-2019-19992 | Medium | 6.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem v… |
CVE-2020-4212 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-5243 | Medium | 5.7 | 2020-02-21 | uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression… |
CVE-2020-6977 | Medium | 6.8 | 2020-02-20 | A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user t… |
CVE-2015-4410 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of ser… |
CVE-2014-4657 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2015-2923 | Medium | 6.5 | 2020-02-20 | The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a… |
CVE-2020-3160 | Medium | 5.3 | 2020-02-19 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attack… |
CVE-2014-4651 | Critical | 9.8 | 2020-02-18 | It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensit… |
CVE-2015-1425 | Critical | 9.8 | 2020-02-18 | JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities |
CVE-2020-1811 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exp… |
CVE-2020-1828 | High | 7.5 | 2020-02-17 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R… |
CVE-2013-3738 | Critical | 9.8 | 2020-02-17 | A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user… |
CVE-2020-9013 | Medium | 4.3 | 2020-02-16 | Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code. |
CVE-2020-8843 | High | 7.4 | 2020-02-14 | An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy a… |
CVE-2019-20045 | High | 7.5 | 2020-02-14 | The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets… |
CVE-2018-21033 | Medium | 6.5 | 2020-02-14 | A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to… |
CVE-2020-8614 | Critical | 9.8 | 2020-02-13 | An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network pack… |
CVE-2020-1976 | Medium | 4.7 | 2020-02-12 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS ker… |
CVE-2013-5106 | High | 8.8 | 2020-02-12 | A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. |
CVE-2020-6192 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP La… |
CVE-2020-6191 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP… |
CVE-2020-6177 | Medium | 4.3 | 2020-02-12 | SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of servic… |
CVE-2019-19192 | Medium | 6.5 | 2020-02-12 | The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Prot… |
CVE-2020-7957 | Medium | 5.3 | 2020-02-12 | The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a traili… |
CVE-2020-8815 | High | 7.5 | 2020-02-12 | Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowlor… |
CVE-2020-2110 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming an… |
CVE-2020-2109 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. |
CVE-2014-9390 | Critical | 9.8 | 2020-02-12 | Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows a… |
CVE-2020-0751 | Medium | 6.0 | 2020-02-11 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest oper… |
CVE-2020-0661 | Medium | 6.8 | 2020-02-11 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2013-1607 | Critical | 9.8 | 2020-02-11 | Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability |
CVE-2013-4535 | High | 8.8 | 2020-02-11 | The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related… |
CVE-2020-6416 | High | 8.8 | 2020-02-11 | Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2020-6412 | Medium | 5.4 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6411 | Medium | 5.4 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6402 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious ext… |
CVE-2020-6401 | Medium | 6.5 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6399 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13322 | High | 8.8 | 2020-02-10 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is require… |
CVE-2014-5091 | Critical | 9.8 | 2020-02-07 | A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute… |
CVE-2014-5087 | Critical | 9.8 | 2020-02-07 | A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbi… |
CVE-2014-5468 | High | 8.8 | 2020-02-07 | A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, whic… |
CVE-2014-7224 | High | 8.8 | 2020-02-07 | A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and accessibilityTraversal o… |
CVE-2019-15606 | Critical | 9.8 | 2020-02-07 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons |
CVE-2019-16152 | Medium | 6.5 | 2020-02-06 | A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running un… |
CVE-2011-0220 | Medium | 5.5 | 2020-02-05 | Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet. |
CVE-2010-4815 | Critical | 9.8 | 2020-02-05 | Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. |
CVE-2020-3111 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute cod… |