CWE-20 · Improper Input Validation (page 61)
Page 61 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15019 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid software update image to… |
CVE-2019-0070 | High | 8.8 | 2019-10-09 | An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they… |
CVE-2019-10969 | High | 7.2 | 2019-10-08 | Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may… |
CVE-2018-21020 | High | 7.5 | 2019-10-08 | In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechani… |
CVE-2019-17348 | Medium | 6.5 | 2019-10-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context… |
CVE-2019-17347 | High | 7.8 | 2019-10-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its… |
CVE-2019-17346 | High | 8.8 | 2019-10-08 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility betw… |
CVE-2019-17042 | Critical | 9.8 | 2019-10-07 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to… |
CVE-2019-17132 | Critical | 9.8 | 2019-10-04 | vBulletin through 5.5.4 mishandles custom avatars. |
CVE-2018-10105 | Critical | 9.8 | 2019-10-03 | tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2). |
CVE-2018-10103 | Critical | 9.8 | 2019-10-03 | tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2). |
CVE-2019-12706 | High | 7.5 | 2019-10-02 | A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenti… |
CVE-2019-12701 | Medium | 5.8 | 2019-10-02 | A vulnerability in the file and malware inspection feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker… |
CVE-2019-12699 | High | 7.8 | 2019-10-02 | Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to ex… |
CVE-2019-12694 | Medium | 6.7 | 2019-10-02 | A vulnerability in the command line interface (CLI) of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker with administ… |
CVE-2019-12689 | High | 8.8 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to exec… |
CVE-2019-12688 | High | 8.8 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an… |
CVE-2019-12687 | High | 8.8 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an… |
CVE-2019-12676 | High | 7.4 | 2019-10-02 | A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2019-12673 | High | 7.5 | 2019-10-02 | A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2019-12630 | Critical | 9.8 | 2019-10-02 | A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary comman… |
CVE-2019-12157 | Critical | 9.8 | 2019-10-02 | In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. |
CVE-2019-10538 | Critical | 9.8 | 2019-09-30 | Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can compromise HLOS in Snap… |
CVE-2019-10506 | High | 7.8 | 2019-09-30 | While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained from the user space which could be invali… |
CVE-2019-10501 | High | 7.8 | 2019-09-30 | Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snap… |
CVE-2019-16676 | Critical | 9.8 | 2019-09-30 | Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a metho… |
CVE-2019-9433 | Medium | 6.5 | 2019-09-27 | In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional exe… |
CVE-2019-9432 | High | 7.5 | 2019-09-27 | In Bluetooth, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure in the Bluetooth server… |
CVE-2019-9418 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execut… |
CVE-2019-9414 | Medium | 5.9 | 2019-09-27 | In wpa_supplicant, there is a possible man in the middle vulnerability due to improper input validation of the basicConstraints field of intermediary certifica… |
CVE-2019-9404 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9402 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9401 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9398 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9397 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9396 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9395 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9394 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9393 | High | 7.5 | 2019-09-27 | In Bluetooth, there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution… |
CVE-2019-9379 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execut… |
CVE-2019-9371 | Medium | 6.5 | 2019-09-27 | In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution p… |
CVE-2019-9352 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execut… |
CVE-2019-9348 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2019-9283 | Medium | 6.5 | 2019-09-27 | In AAC Codec, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional executio… |
CVE-2018-11782 | Medium | 6.5 | 2019-09-26 | In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request pr… |
CVE-2015-9415 | High | 7.5 | 2019-09-26 | The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. |
CVE-2019-12669 | High | 7.5 | 2019-09-25 | A vulnerability in the RADIUS Change of Authorization (CoA) code of Cisco TrustSec, a feature within Cisco IOS XE Software, could allow an unauthenticated, rem… |
CVE-2019-12663 | High | 8.6 | 2019-09-25 | A vulnerability in the Cisco TrustSec (CTS) Protected Access Credential (PAC) provisioning module of Cisco IOS XE Software could allow an unauthenticated, remo… |
CVE-2019-12657 | High | 7.5 | 2019-09-25 | A vulnerability in Unified Threat Defense (UTD) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload… |
CVE-2019-12656 | High | 7.5 | 2019-09-25 | A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to s… |
CVE-2019-12655 | High | 7.5 | 2019-09-25 | A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT IPv6 to IPv4 (NAT64), and the Zone-Base… |
CVE-2019-12653 | High | 7.5 | 2019-09-25 | A vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected… |
CVE-2019-6654 | Medium | 4.3 | 2019-09-25 | On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As defined in RFC 181… |
CVE-2019-3416 | Critical | 9.8 | 2019-09-23 | All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can t… |
CVE-2019-16412 | High | 7.5 | 2019-09-19 | In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enf… |
CVE-2019-4271 | Low | 3.5 | 2019-09-17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 16… |
CVE-2016-10991 | High | 7.5 | 2019-09-17 | The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. |
CVE-2016-10960 | High | 8.8 | 2019-09-16 | The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter. |
CVE-2016-10956 | High | 7.5 | 2019-09-16 | The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php. |
CVE-2019-10937 | High | 7.5 | 2019-09-13 | A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could cause a Denial-of-Servic… |
CVE-2018-7081 | Critical | 9.8 | 2019-09-13 | A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit speciall… |
CVE-2016-10948 | High | 8.1 | 2019-09-13 | The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. |
CVE-2019-5976 | Medium | 4.9 | 2019-09-12 | Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. |
CVE-2019-1306 | Critical | 9.8 | 2019-09-11 | A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps… |
CVE-2019-1302 | High | 8.8 | 2019-09-11 | An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web… |
CVE-2019-1296 | High | 8.8 | 2019-09-11 | A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Rem… |
CVE-2019-1295 | High | 8.8 | 2019-09-11 | A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Rem… |
CVE-2019-1264 | High | 7.8 | 2019-09-11 | A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'. |
CVE-2019-1257 | High | 8.8 | 2019-09-11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2019-0928 | Medium | 6.2 | 2019-09-11 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-3760 | Medium | 6.4 | 2019-09-11 | The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Wo… |
CVE-2019-5461 | Low | 3.5 | 2019-09-09 | An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a… |
CVE-2019-15639 | High | 7.5 | 2019-09-09 | main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific sc… |
CVE-2019-16142 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a m… |
CVE-2019-16141 | High | 7.5 | 2019-09-09 | An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy. |
CVE-2019-9453 | Medium | 4.4 | 2019-09-06 | In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclo… |
CVE-2019-9446 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to improper input validation. This could lead to a local… |
CVE-2019-9441 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the mnh driver there is a possible out of bounds write due to improper input validation. This could lead to escalation of privilege wi… |
CVE-2019-9254 | High | 7.8 | 2019-09-05 | In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. This could lead to local escalation o… |
CVE-2019-12645 | High | 7.8 | 2019-09-05 | A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, lo… |
CVE-2019-12633 | High | 7.5 | 2019-09-05 | A vulnerability in Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to bypass access controls and conduct a s… |
CVE-2019-12632 | High | 7.5 | 2019-09-05 | A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) att… |
CVE-2019-12588 | Medium | 6.5 | 2019-09-04 | The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-5611 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE… |
CVE-2019-1969 | Medium | 5.3 | 2019-08-30 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an… |
CVE-2019-1968 | High | 7.5 | 2019-08-30 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2019-14979 | Medium | 5.3 | 2019-08-29 | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such… |
CVE-2019-14978 | Medium | 5.3 | 2019-08-29 | /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as… |
CVE-2019-11247 | High | 8.1 | 2019-08-29 | The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authoriza… |
CVE-2019-10054 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access… |
CVE-2019-1964 | High | 8.6 | 2019-08-28 | A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the ne… |
CVE-2019-1963 | High | 7.7 | 2019-08-28 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenti… |
CVE-2019-1962 | High | 8.6 | 2019-08-28 | A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause process crashes, which… |
CVE-2019-13270 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order… |
CVE-2019-13269 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R… |
CVE-2019-13268 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2015-9351 | Critical | 9.8 | 2019-08-27 | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. |
CVE-2015-9348 | High | 7.5 | 2019-08-27 | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. |
CVE-2015-9345 | High | 7.5 | 2019-08-27 | The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. |