CWE-20 · Improper Input Validation (page 60)
Page 60 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16761 | Medium | 5.7 | 2019-11-15 | A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm pa… |
CVE-2019-6663 | Medium | 5.5 | 2019-11-15 | The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, an… |
CVE-2011-0703 | Critical | 9.8 | 2019-11-15 | In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session. |
CVE-2019-14591 | Medium | 5.5 | 2019-11-14 | Improper input validation in the API for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial o… |
CVE-2019-11089 | Medium | 5.5 | 2019-11-14 | Insufficient input validation in Kernel Mode module for Intel(R) Graphics Driver before version 25.20.100.6519 may allow an authenticated user to potentially e… |
CVE-2018-12207 | Medium | 6.5 | 2019-11-14 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentiall… |
CVE-2019-0149 | Medium | 5.5 | 2019-11-14 | Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially… |
CVE-2019-0147 | Medium | 5.5 | 2019-11-14 | Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially en… |
CVE-2019-14566 | High | 7.8 | 2019-11-14 | Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalat… |
CVE-2019-11180 | High | 7.5 | 2019-11-14 | Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service vi… |
CVE-2019-11179 | Medium | 6.5 | 2019-11-14 | Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure… |
CVE-2019-11175 | High | 7.5 | 2019-11-14 | Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service vi… |
CVE-2019-11137 | High | 8.2 | 2019-11-14 | Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5… |
CVE-2012-1168 | High | 8.2 | 2019-11-14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified. |
CVE-2019-0396 | High | 7.1 | 2019-11-13 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML… |
CVE-2019-9467 | Medium | 6.7 | 2019-11-13 | In the Bootloader, there is a possible kernel command injection due to missing command sanitization. This could lead to a local elevation of privilege with Sys… |
CVE-2019-2195 | High | 7.8 | 2019-11-13 | In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could lead to local escalat… |
CVE-2019-2192 | High | 7.8 | 2019-11-13 | In call of SliceProvider.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with n… |
CVE-2019-16949 | Medium | 6.5 | 2019-11-13 | An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at… |
CVE-2019-5230 | Medium | 5.5 | 2019-11-13 | P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T… |
CVE-2010-3439 | Medium | 6.5 | 2019-11-12 | It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command. |
CVE-2019-1399 | Medium | 6.2 | 2019-11-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-1398 | High | 8.4 | 2019-11-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-1397 | High | 8.4 | 2019-11-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-1389 | High | 8.4 | 2019-11-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-1310 | Medium | 6.8 | 2019-11-12 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-1309 | Medium | 6.8 | 2019-11-12 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0721 | Critical | 9.1 | 2019-11-12 | A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o… |
CVE-2019-0719 | Critical | 9.1 | 2019-11-12 | A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o… |
CVE-2019-0712 | Medium | 6.8 | 2019-11-12 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2010-3359 | Medium | 4.8 | 2019-11-12 | If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick anot… |
CVE-2011-2897 | Critical | 9.8 | 2019-11-12 | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
CVE-2009-5004 | Medium | 6.5 | 2019-11-09 | qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use . |
CVE-2009-3614 | Low | 3.3 | 2019-11-09 | liboping 1.3.2 allows users reading arbitrary files upon the local system. |
CVE-2019-3426 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit t… |
CVE-2013-1889 | High | 7.5 | 2019-11-08 | mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out of the chroot. |
CVE-2013-1820 | Medium | 5.5 | 2019-11-08 | tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. |
CVE-2013-1811 | Medium | 4.3 | 2019-11-07 | An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". |
CVE-2013-1751 | Critical | 9.8 | 2019-11-07 | TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick cha… |
CVE-2010-2476 | Critical | 9.8 | 2019-11-07 | syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that… |
CVE-2010-2449 | Medium | 6.5 | 2019-11-07 | Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary file via a symlink attack. |
CVE-2010-2447 | Critical | 9.8 | 2019-11-07 | gitolite before 1.4.1 does not filter src/ or hooks/ from path names. |
CVE-2010-2473 | Medium | 6.5 | 2019-11-07 | Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked coul… |
CVE-2012-0051 | High | 7.4 | 2019-11-07 | Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. |
CVE-2010-2243 | High | 7.5 | 2019-11-07 | A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/device… |
CVE-2014-9013 | High | 8.8 | 2019-11-06 | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary use… |
CVE-2011-2808 | Medium | 6.5 | 2019-11-06 | A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with autofocus is accessed. |
CVE-2009-5050 | High | 7.5 | 2019-11-06 | konversation before 1.2.3 allows attackers to cause a denial of service. |
CVE-2011-4904 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint… |
CVE-2011-4902 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. |
CVE-2010-2446 | Critical | 9.8 | 2019-11-06 | Rbot Reaction plugin allows command execution |
CVE-2019-1981 | Medium | 5.8 | 2019-11-05 | A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1978 | Medium | 5.8 | 2019-11-05 | A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1789 | High | 7.5 | 2019-11-05 | ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE fi… |
CVE-2019-15966 | High | 7.7 | 2019-11-05 | A vulnerability in the web application of Cisco TelePresence Advanced Media Gateway could allow an authenticated, remote attacker to cause a denial of service… |
CVE-2010-3667 | Medium | 5.3 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element. |
CVE-2015-8980 | Critical | 9.8 | 2019-11-04 | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. |
CVE-2013-4409 | Critical | 9.8 | 2019-11-04 | An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. |
CVE-2019-17210 | High | 7.5 | 2019-11-04 | A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserial… |
CVE-2005-4890 | High | 7.8 | 2019-11-04 | There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the paren… |
CVE-2013-2259 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview |
CVE-2013-4103 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input |
CVE-2013-4101 | Medium | 5.3 | 2019-11-04 | Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness |
CVE-2013-4100 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.22 has Remote Denial of Service via username |
CVE-2013-0180 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds. |
CVE-2013-0178 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm. |
CVE-2013-0165 | High | 7.3 | 2019-11-01 | cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. |
CVE-2013-2227 | High | 7.5 | 2019-11-01 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php. |
CVE-2013-4751 | High | 8.1 | 2019-11-01 | php-symfony2-Validator has loss of information during serialization |
CVE-2013-3718 | Medium | 5.5 | 2019-11-01 | evince is missing a check on number of pages which can lead to a segmentation fault |
CVE-2019-18228 | High | 7.5 | 2019-10-31 | Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HTTP packet request… |
CVE-2012-6125 | Critical | 9.8 | 2019-10-31 | Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. |
CVE-2012-6123 | Medium | 6.5 | 2019-10-31 | Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack." |
CVE-2013-1930 | Medium | 4.3 | 2019-10-31 | MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. |
CVE-2013-1910 | Critical | 9.8 | 2019-10-31 | yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse… |
CVE-2010-2490 | Medium | 6.5 | 2019-10-31 | Mumble: murmur-server has DoS due to malformed client query |
CVE-2010-0748 | Critical | 9.8 | 2019-10-30 | Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments i… |
CVE-2010-2061 | High | 7.8 | 2019-10-29 | rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemon is started. |
CVE-2012-0694 | Critical | 9.8 | 2019-10-29 | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. |
CVE-2010-1678 | High | 7.5 | 2019-10-29 | Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing. |
CVE-2010-3375 | Critical | 9.8 | 2019-10-29 | qtparted has insecure library loading which may allow arbitrary code execution |
CVE-2010-3373 | Medium | 5.5 | 2019-10-29 | paxtest handles temporary files insecurely |
CVE-2010-4239 | Critical | 9.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has Local File Inclusion |
CVE-2010-3293 | Medium | 5.5 | 2019-10-28 | mailscanner can allow local users to prevent virus signatures from being updated |
CVE-2002-2444 | Critical | 9.8 | 2019-10-28 | Snoopy before 2.0.0 has a security hole in exec cURL |
CVE-2019-3982 | Medium | 6.5 | 2019-10-23 | Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of specific imported scan types. An authen… |
CVE-2014-2304 | High | 7.5 | 2019-10-23 | A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller servic… |
CVE-2013-7333 | High | 7.5 | 2019-10-23 | A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selective… |
CVE-2019-12290 | High | 7.5 | 2019-10-22 | GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in… |
CVE-2019-13541 | High | 7.8 | 2019-10-18 | In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking us… |
CVE-2019-11253 | High | 7.5 | 2019-10-17 | Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized us… |
CVE-2019-16699 | Critical | 9.8 | 2019-10-16 | The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary… |
CVE-2019-15274 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injection… |
CVE-2019-15273 | Medium | 4.4 | 2019-10-16 | Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitr… |
CVE-2019-15265 | Medium | 6.5 | 2019-10-16 | A vulnerability in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs) could allow an unauthenticated, adjacent… |
CVE-2019-15262 | High | 7.5 | 2019-10-16 | A vulnerability in the Secure Shell (SSH) session management for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker t… |
CVE-2019-15261 | High | 8.6 | 2019-10-16 | A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthe… |
CVE-2019-17507 | High | 7.5 | 2019-10-11 | An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location… |
CVE-2019-1230 | Medium | 6.8 | 2019-10-10 | An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an auth… |
CVE-2019-5700 | High | 7.8 | 2019-10-09 | NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate the fields of the boo… |