CWE-20 · Improper Input Validation (page 59)
Page 59 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8802 | High | 7.8 | 2019-12-18 | A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15.1. A malicious application may be able to gain root privilege… |
CVE-2019-8794 | Medium | 5.5 | 2019-12-18 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS… |
CVE-2019-8788 | High | 7.5 | 2019-12-18 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catali… |
CVE-2019-8724 | High | 8.8 | 2019-12-18 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without pro… |
CVE-2019-8723 | High | 8.8 | 2019-12-18 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without pro… |
CVE-2019-8722 | High | 8.8 | 2019-12-18 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without pro… |
CVE-2019-8721 | High | 8.8 | 2019-12-18 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without pro… |
CVE-2019-8711 | Medium | 5.3 | 2019-12-18 | A logic issue existed with the display of notification previews. This issue was addressed with improved validation. This issue is fixed in iOS 13. Notification… |
CVE-2019-8698 | Low | 3.3 | 2019-12-18 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2019-8670 | Medium | 4.3 | 2019-12-18 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malic… |
CVE-2019-8665 | High | 7.5 | 2019-12-18 | A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.4, watchOS 5.3. A remote attacker may cause an unexpected appli… |
CVE-2019-8654 | Medium | 6.5 | 2019-12-18 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.1. Visiting a malicious website may lead… |
CVE-2019-8637 | High | 7.8 | 2019-12-18 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A malicious application may… |
CVE-2019-8626 | Medium | 6.5 | 2019-12-18 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted messag… |
CVE-2019-8566 | Low | 3.3 | 2019-12-18 | An API issue existed in the handling of microphone data. This issue was addressed with improved validation. This issue is fixed in iOS 12.2. A malicious applic… |
CVE-2019-8561 | High | 7.8 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to elevate privileges. |
CVE-2019-8549 | High | 7.8 | 2019-12-18 | Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mo… |
CVE-2019-8516 | High | 7.5 | 2019-12-18 | A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously c… |
CVE-2019-8515 | Medium | 6.5 | 2019-12-18 | A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iT… |
CVE-2019-8507 | Medium | 5.5 | 2019-12-18 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lea… |
CVE-2019-8503 | High | 8.8 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7… |
CVE-2019-8502 | Low | 3.3 | 2019-12-18 | An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10… |
CVE-2019-7292 | Medium | 6.5 | 2019-12-18 | A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud f… |
CVE-2019-2304 | High | 7.8 | 2019-12-18 | Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Co… |
CVE-2019-10595 | High | 7.8 | 2019-12-18 | Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware in Snapdragon Auto, Snapdrag… |
CVE-2014-8179 | High | 7.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during… |
CVE-2014-8178 | Medium | 5.5 | 2019-12-17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attac… |
CVE-2019-14609 | Medium | 6.7 | 2019-12-16 | Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2019-5260 | Medium | 6.5 | 2019-12-13 | Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing… |
CVE-2019-13932 | Critical | 9.1 | 2019-12-12 | A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web application requests could be manipulated, causing the the application to behave… |
CVE-2014-0091 | Medium | 5.3 | 2019-12-11 | Foreman has improper input validation which could lead to partial Denial of Service |
CVE-2013-4245 | High | 7.3 | 2019-12-11 | Orca has arbitrary code execution due to insecure Python module load |
CVE-2019-1484 | High | 7.8 | 2019-12-10 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabi… |
CVE-2019-1471 | High | 8.2 | 2019-12-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-1470 | Medium | 6.0 | 2019-12-10 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2019-13750 | Medium | 6.5 | 2019-12-10 | Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML… |
CVE-2013-1689 | Medium | 6.5 | 2019-12-10 | Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. |
CVE-2013-0342 | Medium | 4.3 | 2019-12-09 | The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting th… |
CVE-2019-2232 | High | 7.5 | 2019-12-06 | In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when process… |
CVE-2019-7193 | Critical | 9.8 | 2019-12-05 | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating… |
CVE-2019-11255 | Medium | 4.8 | 2019-12-05 | Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4… |
CVE-2013-0243 | High | 7.4 | 2019-12-05 | haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections |
CVE-2019-19579 | Medium | 6.8 | 2019-12-04 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a ph… |
CVE-2019-17555 | High | 7.5 | 2019-12-04 | The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any… |
CVE-2016-1000104 | High | 8.8 | 2019-12-03 | A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07. |
CVE-2013-2103 | High | 8.1 | 2019-12-03 | OpenShift cartridge allows remote URL retrieval |
CVE-2012-4576 | High | 7.8 | 2019-12-02 | FreeBSD: Input Validation Flaw allows local users to gain elevated privileges |
CVE-2019-19396 | High | 7.5 | 2019-11-29 | illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg concurrently over… |
CVE-2019-5268 | High | 8.1 | 2019-11-29 | Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability b… |
CVE-2015-1855 | Medium | 5.9 | 2019-11-29 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate… |
CVE-2019-19376 | Medium | 6.5 | 2019-11-28 | In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and c… |
CVE-2019-18247 | High | 7.5 | 2019-11-27 | An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3.18, 2.0.0.11, 2.1… |
CVE-2019-15705 | High | 7.5 | 2019-11-27 | An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote a… |
CVE-2012-2248 | High | 8.1 | 2019-11-27 | An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable. |
CVE-2011-4310 | High | 7.5 | 2019-11-26 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. |
CVE-2011-4120 | Critical | 9.8 | 2019-11-26 | Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'suffi… |
CVE-2019-15997 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary command… |
CVE-2019-15988 | Medium | 5.3 | 2019-11-26 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2019-15986 | Medium | 6.7 | 2019-11-26 | A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2019-15971 | Medium | 4.3 | 2019-11-26 | A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker… |
CVE-2019-15958 | Critical | 9.8 | 2019-11-26 | A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote… |
CVE-2019-15288 | High | 8.8 | 2019-11-26 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authentic… |
CVE-2019-15276 | Medium | 6.5 | 2019-11-26 | A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial o… |
CVE-2019-19249 | Critical | 9.8 | 2019-11-25 | Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations. |
CVE-2019-5864 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass… |
CVE-2019-5862 | Medium | 6.5 | 2019-11-25 | Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass si… |
CVE-2019-5858 | High | 8.8 | 2019-11-25 | Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a cra… |
CVE-2019-5856 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2019-5852 | Medium | 6.5 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from pr… |
CVE-2019-13707 | Medium | 5.5 | 2019-11-25 | Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted ap… |
CVE-2019-13692 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML pag… |
CVE-2019-13675 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page. |
CVE-2012-5582 | Critical | 9.8 | 2019-11-25 | opendnssec misuses libcurl API |
CVE-2019-10563 | High | 7.8 | 2019-11-21 | Buffer over-read can occur in fast message handler due to improper input validation while processing a message from firmware in Snapdragon Auto, Snapdragon Con… |
CVE-2019-10535 | Medium | 5.5 | 2019-11-21 | Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto… |
CVE-2014-1937 | High | 7.5 | 2019-11-21 | Gamera before 3.4.1 insecurely creates temporary files. |
CVE-2014-1936 | High | 7.5 | 2019-11-21 | rc before 1.7.1-5 insecurely creates temporary files. |
CVE-2014-1935 | Medium | 5.3 | 2019-11-21 | 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames. |
CVE-2014-0084 | Medium | 5.5 | 2019-11-21 | Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly. |
CVE-2012-4524 | High | 7.5 | 2019-11-21 | xlockmore before 5.43 'dclock' security bypass vulnerability |
CVE-2012-3460 | Critical | 9.8 | 2019-11-21 | cumin: At installation postgresql database user created without password |
CVE-2013-7172 | High | 7.8 | 2019-11-21 | Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package, which could allow… |
CVE-2013-7171 | Critical | 9.8 | 2019-11-21 | Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which could allow remote attack… |
CVE-2012-3543 | High | 7.5 | 2019-11-21 | mono 2.10.x ASP.NET Web Form Hash collision DoS |
CVE-2012-2350 | High | 7.5 | 2019-11-21 | pam_shield before 0.9.4: Default configuration does not perform protective action |
CVE-2013-2093 | Critical | 9.8 | 2019-11-20 | Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2015-1607 | Medium | 5.5 | 2019-11-20 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attac… |
CVE-2011-0529 | High | 7.5 | 2019-11-20 | Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP. |
CVE-2010-4660 | Critical | 9.8 | 2019-11-20 | Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes.. |
CVE-2011-1028 | Critical | 9.8 | 2019-11-20 | The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_var… |
CVE-2019-11289 | High | 8.6 | 2019-11-19 | Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route s… |
CVE-2011-2922 | High | 7.8 | 2019-11-19 | ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and use the "GTK_MODULES"… |
CVE-2012-6135 | High | 7.5 | 2019-11-19 | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. |
CVE-2012-6070 | High | 7.5 | 2019-11-19 | Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks. |
CVE-2011-4968 | Medium | 4.8 | 2019-11-19 | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) |
CVE-2011-4967 | High | 7.5 | 2019-11-19 | tog-Pegasus has a package hash collision DoS vulnerability |
CVE-2014-5118 | Medium | 5.5 | 2019-11-18 | Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability |
CVE-2012-4438 | High | 8.8 | 2019-11-18 | Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrar… |
CVE-2019-16762 | Medium | 5.7 | 2019-11-15 | A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An att… |