CWE-20 · Improper Input Validation (page 59)
Page 59 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0534 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to pot… |
CVE-2020-0532 | High | 7.1 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0531 | Medium | 6.5 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentially enable informa… |
CVE-2020-13170 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary d… |
CVE-2020-0207 | Medium | 6.5 | 2020-06-11 | In next_marker of jdmarker.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no… |
CVE-2020-0206 | Medium | 5.5 | 2020-06-11 | In the settings app, there is a possible app crash due to improper input validation. This could lead to local denial of service of the Settings app with User e… |
CVE-2020-0196 | Medium | 6.5 | 2020-06-11 | In RegisterNotificationResponse::GetEvent of register_notification_packet.cc, there is a possible abort due to improper input validation. This could lead to re… |
CVE-2020-0192 | Medium | 6.5 | 2020-06-11 | In ih264d_decode_slice_thread of ih264d_thread_parse_decode.c, there is a possible out of bounds read due to improper input validation. This could lead to remo… |
CVE-2020-0179 | High | 7.8 | 2020-06-11 | In doSendObjectInfo of MtpServer.cpp, there is a possible path traversal attack due to insufficient input validation. This could lead to local escalation of pr… |
CVE-2020-0176 | High | 7.5 | 2020-06-11 | In avdt_msg_prs_rej of avdt_msg.cc, there is a possible out-of-bounds read due to improper input validation. This could lead to remote information disclosure w… |
CVE-2020-0175 | Medium | 6.5 | 2020-06-11 | In XMF_ReadNode of eas_xmf.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no addit… |
CVE-2020-0174 | Medium | 6.5 | 2020-06-11 | In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0173 | Medium | 6.5 | 2020-06-11 | In Parse_lins of eas_mdls.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additi… |
CVE-2020-0172 | Medium | 6.5 | 2020-06-11 | In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional… |
CVE-2020-0171 | Medium | 6.5 | 2020-06-11 | In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0170 | Medium | 6.5 | 2020-06-11 | In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-0169 | Medium | 6.5 | 2020-06-11 | In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-0166 | High | 7.8 | 2020-06-11 | In multiple functions of URI.java, there is a possible escalation of privilege due to missing validation in the parceling of URI information. This could lead t… |
CVE-2020-0163 | Medium | 6.5 | 2020-06-11 | In parseSampleAuxiliaryInformationSizes of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remot… |
CVE-2020-0162 | Medium | 6.5 | 2020-06-11 | In parseSampleAuxiliaryInformationOffsets of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to rem… |
CVE-2020-0161 | Medium | 6.5 | 2020-06-11 | In parseChunk of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with n… |
CVE-2020-0160 | High | 8.8 | 2020-06-11 | In setSyncSampleParams of SampleTable.cpp, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service wit… |
CVE-2020-0118 | High | 7.8 | 2020-06-10 | In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of pr… |
CVE-2020-4433 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with in… |
CVE-2020-1286 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerabi… |
CVE-2020-1239 | High | 8.8 | 2020-06-09 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-9855 | High | 7.8 | 2020-06-09 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2020-9829 | Medium | 6.5 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5. Processing a ma… |
CVE-2020-9826 | High | 7.5 | 2020-06-09 | A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A remote attac… |
CVE-2020-9803 | High | 8.8 | 2020-06-09 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, i… |
CVE-2020-9793 | High | 7.8 | 2020-06-09 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, w… |
CVE-2020-9788 | High | 7.8 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.5. A file may be incorrectly rendered to execute… |
CVE-2020-9792 | Medium | 4.6 | 2020-06-09 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A USB device may be… |
CVE-2020-12803 | Medium | 6.5 | 2020-06-08 | ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an exte… |
CVE-2020-13646 | High | 7.8 | 2020-06-05 | In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2020-10068 | Medium | 5.1 | 2020-06-05 | In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issu… |
CVE-2020-12852 | Medium | 6.8 | 2020-06-04 | The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update… |
CVE-2020-13835 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials… |
CVE-2020-13832 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code executio… |
CVE-2020-3257 | High | 8.1 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3238 | High | 8.1 | 2020-06-03 | A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or… |
CVE-2020-3235 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches cou… |
CVE-2020-3230 | High | 7.5 | 2020-06-03 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r… |
CVE-2020-3228 | High | 8.6 | 2020-06-03 | A vulnerability in Security Group Tag Exchange Protocol (SXP) in Cisco IOS Software, Cisco IOS XE Software, and Cisco NX-OS Software could allow an unauthentic… |
CVE-2020-3226 | High | 8.6 | 2020-06-03 | A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2020-3225 | High | 8.6 | 2020-06-03 | Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an u… |
CVE-2020-3221 | High | 8.6 | 2020-06-03 | A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an… |
CVE-2020-3219 | High | 8.8 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrati… |
CVE-2020-3218 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code w… |
CVE-2020-3217 | High | 8.8 | 2020-06-03 | A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Ci… |
CVE-2020-3215 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an aff… |
CVE-2020-3214 | Medium | 6.7 | 2020-06-03 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vu… |
CVE-2020-3206 | Medium | 4.7 | 2020-06-03 | A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IO… |
CVE-2020-3205 | High | 8.8 | 2020-06-03 | A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial IS… |
CVE-2020-3204 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3201 | Medium | 6.0 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3199 | High | 8.8 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3322 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3321 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3319 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3623 | High | 7.8 | 2020-06-02 | kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130 |
CVE-2019-14038 | High | 7.1 | 2020-06-02 | Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapd… |
CVE-2020-13401 | Medium | 6.0 | 2020-06-02 | An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, an… |
CVE-2019-15709 | Medium | 6.5 | 2020-06-01 | An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators… |
CVE-2020-12062 | High | 7.5 | 2020-06-01 | The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user… |
CVE-2020-6868 | Medium | 6.5 | 2020-06-01 | There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The f… |
CVE-2020-13634 | High | 7.8 | 2020-05-29 | In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or… |
CVE-2020-4231 | Medium | 6.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. I… |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-5537 | Critical | 9.8 | 2020-05-25 | Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors. |
CVE-2020-3314 | Medium | 6.1 | 2020-05-22 | A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files… |
CVE-2020-3280 | Critical | 9.8 | 2020-05-22 | A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker t… |
CVE-2020-3272 | High | 7.5 | 2020-05-22 | A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2020-1195 | Low | 3.1 | 2020-05-21 | An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input. An attacker who succe… |
CVE-2020-1173 | Medium | 6.8 | 2020-05-21 | A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker… |
CVE-2020-1084 | Medium | 5.5 | 2020-05-21 | A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values. An attacker who succe… |
CVE-2020-1081 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers. An authenticated… |
CVE-2020-10738 | High | 7.5 | 2020-05-21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible… |
CVE-2020-6485 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2020-7137 | Medium | 6.7 | 2020-05-19 | A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.25.46 or later to re… |
CVE-2020-1695 | High | 7.5 | 2020-05-19 | A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation… |
CVE-2020-4411 | High | 7.1 | 2020-05-19 | The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel mo… |
CVE-2020-10967 | Medium | 5.3 | 2020-05-18 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. |
CVE-2020-13111 | High | 7.5 | 2020-05-16 | NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote at… |
CVE-2020-3810 | Medium | 5.5 | 2020-05-15 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb file… |
CVE-2020-8100 | Critical | 9.0 | 2020-05-15 | Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while s… |
CVE-2020-2011 | High | 7.5 | 2020-05-13 | An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a… |
CVE-2020-1714 | High | 8.8 | 2020-05-13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker… |
CVE-2020-7454 | Critical | 9.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not p… |
CVE-2019-15880 | Critical | 9.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on… |
CVE-2020-12742 | Medium | 6.1 | 2020-05-13 | The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. |
CVE-2020-3341 | High | 7.5 | 2020-05-13 | A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker… |
CVE-2020-3327 | High | 7.5 | 2020-05-13 | A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause… |
CVE-2020-6248 | High | 7.2 | 2020-05-12 | SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP o… |
CVE-2020-10058 | High | 7.8 | 2020-05-11 | Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges… |
CVE-2020-10028 | High | 7.8 | 2020-05-11 | Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. versio… |
CVE-2020-12752 | High | 7.5 | 2020-05-11 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force a… |
CVE-2018-20225 | High | 7.8 | 2020-05-08 | An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a privat… |
CVE-2020-7803 | High | 7.8 | 2020-05-07 | IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGT… |