CWE-20 · Improper Input Validation (page 58)
Page 58 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3110 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent… |
CVE-2020-8517 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to me… |
CVE-2020-8125 | Critical | 9.8 | 2020-02-04 | Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial… |
CVE-2020-8124 | Medium | 5.3 | 2020-02-04 | Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks. |
CVE-2020-8122 | Medium | 4.3 | 2020-02-04 | A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. |
CVE-2019-15624 | Medium | 4.9 | 2020-02-04 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. |
CVE-2019-15613 | High | 8.0 | 2020-02-04 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. |
CVE-2014-8126 | High | 8.8 | 2020-01-31 | The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code. |
CVE-2016-2031 | Critical | 9.8 | 2020-01-31 | Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of… |
CVE-2020-8095 | Medium | 4.9 | 2020-01-30 | A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of servic… |
CVE-2020-3147 | High | 7.5 | 2020-01-30 | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on… |
CVE-2020-8445 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed lo… |
CVE-2020-5215 | Medium | 5.0 | 2020-01-28 | In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format chec… |
CVE-2019-4620 | High | 7.8 | 2020-01-28 | IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-For… |
CVE-2014-2914 | Critical | 9.8 | 2020-01-28 | fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbi… |
CVE-2013-2571 | Critical | 9.8 | 2020-01-28 | Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a crafted request to TCP p… |
CVE-2019-5464 | Critical | 9.8 | 2020-01-28 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is u… |
CVE-2020-8087 | Critical | 9.8 | 2020-01-27 | SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated… |
CVE-2019-20430 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validation for specific fi… |
CVE-2020-3139 | Medium | 5.3 | 2020-01-26 | A vulnerability in the out of band (OOB) management interface IP table rule programming for Cisco Application Policy Infrastructure Controller (APIC) could all… |
CVE-2020-3134 | Medium | 6.5 | 2020-01-26 | A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2019-16029 | Critical | 9.1 | 2020-01-26 | A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to chang… |
CVE-2019-16027 | Medium | 6.5 | 2020-01-26 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS X… |
CVE-2019-16026 | Medium | 5.9 | 2020-01-26 | A vulnerability in the implementation of the Stream Control Transmission Protocol (SCTP) on Cisco Mobility Management Entity (MME) could allow an unauthenticat… |
CVE-2019-16005 | High | 7.2 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on… |
CVE-2019-1354 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1352 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1350 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1349 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2020-6965 | Critical | 9.9 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2015-2689 | High | 7.5 | 2020-01-24 | Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote… |
CVE-2015-1525 | Medium | 5.5 | 2020-01-24 | audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted applicatio… |
CVE-2020-6963 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2020-6962 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2012-5699 | Critical | 9.8 | 2020-01-23 | BabyGekko before 1.2.4 allows PHP file inclusion. |
CVE-2019-19836 | Critical | 9.8 | 2020-01-22 | AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp… |
CVE-2011-3611 | High | 7.2 | 2020-01-22 | A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12. |
CVE-2020-6638 | High | 7.5 | 2020-01-21 | Grin through 2.1.1 has Insufficient Validation. |
CVE-2015-2784 | Critical | 9.8 | 2020-01-21 | The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input. |
CVE-2019-14010 | High | 7.5 | 2020-01-21 | The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same… |
CVE-2019-9503 | High | 7.9 | 2020-01-16 | The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver r… |
CVE-2019-11998 | Medium | 5.5 | 2020-01-16 | HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could al… |
CVE-2019-13524 | High | 7.5 | 2020-01-16 | GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow… |
CVE-2019-13939 | High | 7.1 | 2020-01-16 | A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact… |
CVE-2019-15961 | High | 7.5 | 2020-01-15 | A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacke… |
CVE-2015-6497 | High | 8.8 | 2020-01-15 | The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before… |
CVE-2015-5230 | High | 7.5 | 2020-01-15 | The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (cra… |
CVE-2012-1326 | High | 7.4 | 2020-01-15 | Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM att… |
CVE-2012-0334 | Medium | 6.4 | 2020-01-15 | Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which could allow man-in-the-middle attacks |
CVE-2020-7058 | High | 8.8 | 2020-01-15 | data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the… |
CVE-2020-0617 | Medium | 6.0 | 2020-01-14 | A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileged user on a guest… |
CVE-2020-0606 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2020-0605 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2018-1002104 | Medium | 5.3 | 2020-01-14 | Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. |
CVE-2011-3203 | Critical | 9.8 | 2020-01-14 | A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2. |
CVE-2020-6304 | High | 7.5 | 2020-01-14 | Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRN… |
CVE-2015-3150 | High | 7.1 | 2020-01-14 | abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to… |
CVE-2014-2271 | High | 8.1 | 2020-01-14 | cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the… |
CVE-2012-4603 | High | 7.8 | 2020-01-10 | Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary co… |
CVE-2012-4030 | High | 7.5 | 2020-01-10 | Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. |
CVE-2014-5092 | High | 8.8 | 2020-01-10 | Status2k allows Remote Command Execution in admin/options/editpl.php. |
CVE-2016-6585 | Medium | 5.3 | 2020-01-08 | A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious user conduct a man-in… |
CVE-2019-19495 | Critical | 9.8 | 2020-01-08 | The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScri… |
CVE-2016-6586 | Low | 3.7 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16, which could let a malicious user conduct a man-in-the-middle… |
CVE-2016-6589 | Medium | 6.5 | 2020-01-08 | A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0. |
CVE-2019-6529 | Medium | 4.9 | 2020-01-07 | An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166). |
CVE-2019-14866 | High | 7.3 | 2020-01-07 | In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an… |
CVE-2020-5519 | Critical | 9.8 | 2020-01-06 | The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen. |
CVE-2013-3945 | High | 7.8 | 2020-01-02 | The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag. |
CVE-2014-0048 | Critical | 9.8 | 2020-01-02 | An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. |
CVE-2019-9668 | High | 7.5 | 2019-12-31 | An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service… |
CVE-2014-5289 | Critical | 9.8 | 2019-12-27 | Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request. |
CVE-2019-20041 | Critical | 9.8 | 2019-12-27 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization… |
CVE-2019-19398 | Critical | 9.8 | 2019-12-26 | M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. Due to the input validation logic is incorrect, an attacker can… |
CVE-2019-5266 | High | 7.5 | 2019-12-23 | Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an insufficient input validation vulnerability. Attackers can exploit this vulnerability by… |
CVE-2019-19337 | Medium | 6.5 | 2019-12-23 | A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw… |
CVE-2019-15915 | High | 7.5 | 2019-12-20 | An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices. Attackers can utilize the "discover ZigBee network procedure" to perform a… |
CVE-2019-15914 | High | 7.5 | 2019-12-20 | An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Attackers can use the ZigBee trust center rejoin procedure to… |
CVE-2019-15912 | High | 7.5 | 2019-12-20 | An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust center rejoin… |
CVE-2019-15910 | High | 7.5 | 2019-12-20 | An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee netwo… |
CVE-2012-6111 | High | 7.5 | 2019-12-20 | gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function |
CVE-2012-3409 | High | 7.8 | 2019-12-20 | ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation |
CVE-2019-19902 | High | 7.2 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the u… |
CVE-2019-11108 | Medium | 6.7 | 2019-12-18 | Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation o… |
CVE-2019-11107 | Critical | 9.8 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of pr… |
CVE-2019-11104 | High | 7.8 | 2019-12-18 | Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE befo… |
CVE-2019-11103 | High | 7.8 | 2019-12-18 | Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to pote… |
CVE-2019-11102 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in Intel(R) DAL software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TX… |
CVE-2019-11101 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before… |
CVE-2019-11100 | Medium | 4.6 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to po… |
CVE-2019-11088 | High | 8.8 | 2019-12-18 | Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potenti… |
CVE-2019-11087 | Medium | 6.7 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before… |
CVE-2019-11086 | Medium | 6.8 | 2019-12-18 | Insufficient input validation in subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privil… |
CVE-2019-0168 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 m… |
CVE-2019-0166 | High | 7.5 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to po… |
CVE-2019-0165 | Medium | 4.4 | 2019-12-18 | Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable… |
CVE-2019-0131 | High | 8.1 | 2019-12-18 | Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potenti… |
CVE-2019-18995 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing… |
CVE-2019-18994 | Low | 3.9 | 2019-12-18 | Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty… |
CVE-2019-8817 | Medium | 5.5 | 2019-12-18 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.1. An application may be able to read restricted… |