CWE-20 · Improper Input Validation (page 58)
Page 58 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15109 | Medium | 5.3 | 2020-08-04 | In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allo… |
CVE-2020-7823 | High | 7.8 | 2020-08-04 | DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploi… |
CVE-2020-7822 | High | 7.8 | 2020-08-04 | DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could expl… |
CVE-2020-5771 | High | 7.5 | 2020-08-03 | Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious bac… |
CVE-2020-16272 | Critical | 9.1 | 2020-08-03 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read an… |
CVE-2020-3383 | High | 8.8 | 2020-07-31 | A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal… |
CVE-2020-3375 | Critical | 9.8 | 2020-07-31 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnera… |
CVE-2020-3698 | Critical | 9.8 | 2020-07-30 | Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon Auto, Snapdragon Com… |
CVE-2019-14123 | High | 7.8 | 2020-07-30 | Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdrago… |
CVE-2020-15099 | High | 8.1 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages… |
CVE-2020-15098 | High | 8.8 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte… |
CVE-2020-15086 | Critical | 9.8 | 2020-07-29 | In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism… |
CVE-2020-7518 | High | 7.5 | 2020-07-23 | A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configu… |
CVE-2020-10922 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch scre… |
CVE-2020-3452 | High | 7.5 | 2020-07-22 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-6507 | High | 8.8 | 2020-07-22 | Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-21036 | High | 7.5 | 2020-07-21 | Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle… |
CVE-2020-12029 | Critical | 9.0 | 2020-07-20 | All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to e… |
CVE-2020-9255 | Medium | 5.5 | 2020-07-17 | Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability. Certain service in the system does not s… |
CVE-2020-9254 | High | 7.8 | 2020-07-17 | HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 1… |
CVE-2020-7818 | High | 7.8 | 2020-07-17 | DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Att… |
CVE-2020-1644 | High | 7.5 | 2020-07-17 | On Juniper Networks Junos OS and Junos OS Evolved devices, the receipt of a specific BGP UPDATE packet causes an internal counter to be incremented incorrectly… |
CVE-2020-1640 | High | 7.5 | 2020-07-17 | An improper use of a validation framework when processing incoming genuine BGP packets within Juniper Networks RPD (routing protocols process) daemon allows an… |
CVE-2020-5131 | High | 7.8 | 2020-07-17 | SonicWall NetExtender Windows client vulnerable to arbitrary file write vulnerability, this allows attacker to overwrite a DLL and execute code with the same p… |
CVE-2020-5130 | Medium | 5.3 | 2020-07-17 | SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the request. This vulnerabi… |
CVE-2020-3387 | High | 8.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The… |
CVE-2020-3379 | High | 7.8 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operati… |
CVE-2020-3370 | Medium | 5.8 | 2020-07-16 | A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to bypass URL filtering o… |
CVE-2020-3358 | High | 8.6 | 2020-07-16 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause… |
CVE-2020-3357 | Critical | 9.8 | 2020-07-16 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow… |
CVE-2020-3345 | Medium | 4.3 | 2020-07-16 | A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web pa… |
CVE-2020-3323 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote… |
CVE-2020-14503 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker… |
CVE-2020-1355 | High | 7.8 | 2020-07-14 | A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploited the vulnerabili… |
CVE-2020-1350 | Critical | 10.0 | 2020-07-14 | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C… |
CVE-2020-1043 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1042 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1041 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1040 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1036 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1032 | Critical | 9.0 | 2020-07-14 | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest… |
CVE-2020-1025 | Critical | 9.8 | 2020-07-14 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An atta… |
CVE-2020-7588 | Medium | 5.3 | 2020-07-14 | A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Executi… |
CVE-2020-13753 | Critical | 10.0 | 2020-07-14 | The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER coul… |
CVE-2020-8195 | Medium | 6.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-8187 | High | 7.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service… |
CVE-2020-9258 | Medium | 5.5 | 2020-07-10 | HUAWEI P30 smartphone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper input verification vulnerability. An attribution in a module is not… |
CVE-2020-7814 | High | 7.8 | 2020-07-10 | RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file ext… |
CVE-2019-19417 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19416 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19415 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2020-15584 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper imag… |
CVE-2020-15543 | Critical | 9.8 | 2020-07-05 | SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path. |
CVE-2020-15503 | High | 7.5 | 2020-07-02 | LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For… |
CVE-2020-9497 | Medium | 4.4 | 2020-07-02 | Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compro… |
CVE-2020-7821 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the… |
CVE-2020-7820 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the a… |
CVE-2020-5238 | Medium | 6.5 | 2020-07-01 | The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown tab… |
CVE-2020-6261 | Medium | 5.3 | 2020-07-01 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The r… |
CVE-2020-5970 | High | 7.1 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of… |
CVE-2020-14957 | High | 7.8 | 2020-06-30 | In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2020-14956 | High | 7.8 | 2020-06-30 | In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2019-19163 | High | 7.5 | 2020-06-30 | A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code, because of a using the old… |
CVE-2020-3767 | Medium | 6.5 | 2020-06-26 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application… |
CVE-2020-14955 | Medium | 5.5 | 2020-06-26 | In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2020-12033 | High | 8.8 | 2020-06-23 | In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which co… |
CVE-2020-14939 | High | 7.8 | 2020-06-23 | An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game's state. A file can b… |
CVE-2020-1727 | Medium | 6.4 | 2020-06-22 | A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wid… |
CVE-2019-14894 | High | 8.0 | 2020-06-22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch… |
CVE-2020-8102 | High | 8.8 | 2020-06-22 | Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to r… |
CVE-2020-3676 | High | 7.8 | 2020-06-22 | Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Sna… |
CVE-2019-14047 | High | 7.8 | 2020-06-22 | While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon A… |
CVE-2019-10626 | Medium | 5.5 | 2020-06-22 | Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compu… |
CVE-2016-11067 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. |
CVE-2017-18890 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an… |
CVE-2017-18889 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash comma… |
CVE-2018-21264 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response. |
CVE-2017-18873 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misf… |
CVE-2020-8184 | High | 7.5 | 2020-06-19 | A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker… |
CVE-2020-13961 | Medium | 6.5 | 2020-06-19 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any s… |
CVE-2018-21262 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text. |
CVE-2018-21259 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malform… |
CVE-2019-20870 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. |
CVE-2019-20868 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. |
CVE-2020-14459 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. |
CVE-2019-20848 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies. |
CVE-2020-3368 | Medium | 5.8 | 2020-06-18 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-3263 | High | 7.5 | 2020-06-18 | A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vul… |
CVE-2020-3244 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Enhanced Charging Service (ECS) functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remo… |
CVE-2020-7504 | Medium | 5.3 | 2020-06-16 | A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to disable the webser… |
CVE-2020-8543 | High | 7.5 | 2020-06-16 | OX App Suite through 7.10.3 has Improper Input Validation. |
CVE-2020-12001 | Critical | 9.8 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-11999 | High | 8.1 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-9075 | Medium | 6.5 | 2020-06-15 | Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerab… |
CVE-2020-1825 | Medium | 6.5 | 2020-06-15 | FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attacker… |
CVE-2020-0596 | High | 7.5 | 2020-06-15 | Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthentic… |
CVE-2020-0538 | High | 7.5 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0537 | Medium | 4.9 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user to potentially enab… |
CVE-2020-0536 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE version… |
CVE-2020-0535 | Medium | 5.3 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable infor… |