CWE-20 · Improper Input Validation (page 62)
Page 62 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18589 | High | 7.5 | 2019-08-26 | An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic. |
CVE-2019-15640 | High | 7.5 | 2019-08-26 | Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image. |
CVE-2019-12400 | Medium | 5.5 | 2019-08-23 | In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of Docum… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2013-7483 | Critical | 9.8 | 2019-08-22 | The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. |
CVE-2016-10930 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. |
CVE-2019-7617 | High | 7.2 | 2019-08-22 | When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the pr… |
CVE-2019-15324 | High | 8.8 | 2019-08-22 | The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. |
CVE-2018-20985 | Critical | 9.8 | 2019-08-22 | The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. |
CVE-2017-18580 | Critical | 9.8 | 2019-08-22 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. |
CVE-2014-10384 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. |
CVE-2014-10383 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. |
CVE-2018-20981 | Critical | 9.1 | 2019-08-22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. |
CVE-2018-20980 | High | 7.5 | 2019-08-22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. |
CVE-2017-18574 | Medium | 6.1 | 2019-08-22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. |
CVE-2009-5158 | Medium | 6.1 | 2019-08-22 | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. |
CVE-2019-1984 | Medium | 6.5 | 2019-08-21 | A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with adminis… |
CVE-2019-1936 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1839 | Medium | 6.7 | 2019-08-21 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-12626 | Medium | 4.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to co… |
CVE-2016-10899 | Medium | 5.3 | 2019-08-21 | The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. |
CVE-2019-2136 | Medium | 5.5 | 2019-08-20 | In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosu… |
CVE-2019-11140 | Medium | 6.7 | 2019-08-19 | Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of servic… |
CVE-2018-20973 | Critical | 9.8 | 2019-08-16 | The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. |
CVE-2017-18545 | High | 7.5 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. |
CVE-2019-7959 | Critical | 9.8 | 2019-08-16 | Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could l… |
CVE-2019-9851 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2019-9850 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2018-14671 | Critical | 9.8 | 2019-08-15 | In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability. |
CVE-2019-1204 | Medium | 4.3 | 2019-08-14 | An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting… |
CVE-2019-0965 | High | 7.6 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0723 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0720 | High | 8.0 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o… |
CVE-2019-0718 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0717 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0715 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0714 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2017-18509 | High | 7.8 | 2019-08-13 | An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel l… |
CVE-2019-1971 | Critical | 9.8 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command… |
CVE-2019-1961 | Medium | 4.9 | 2019-08-08 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying… |
CVE-2019-1960 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1959 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1955 | High | 7.5 | 2019-08-08 | A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthent… |
CVE-2019-1954 | Medium | 6.1 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a use… |
CVE-2019-1952 | Medium | 6.7 | 2019-08-08 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary… |
CVE-2019-1951 | Medium | 5.8 | 2019-08-08 | A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters… |
CVE-2019-14771 | Critical | 9.8 | 2019-08-08 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line… |
CVE-2019-1945 | Medium | 6.7 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1944 | High | 7.3 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1918 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR So… |
CVE-2019-1910 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS X… |
CVE-2019-14474 | High | 7.5 | 2019-08-07 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial… |
CVE-2016-10812 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). |
CVE-2016-10808 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). |
CVE-2016-10807 | Medium | 6.5 | 2019-08-07 | cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). |
CVE-2016-10805 | High | 8.8 | 2019-08-07 | cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109). |
CVE-2016-10804 | High | 8.1 | 2019-08-07 | The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). |
CVE-2016-10800 | High | 7.8 | 2019-08-07 | cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). |
CVE-2019-1914 | High | 7.2 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a co… |
CVE-2019-13143 | Critical | 9.8 | 2019-08-06 | An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the… |
CVE-2016-10793 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152). |
CVE-2016-10789 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191). |
CVE-2016-10788 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188). |
CVE-2016-10787 | High | 8.1 | 2019-08-06 | The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187). |
CVE-2019-14671 | Low | 3.3 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as fo… |
CVE-2017-18482 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). |
CVE-2017-18475 | High | 8.8 | 2019-08-05 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). |
CVE-2017-18469 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). |
CVE-2016-10775 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). |
CVE-2016-10771 | High | 8.1 | 2019-08-05 | cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). |
CVE-2016-10770 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). |
CVE-2016-10768 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). |
CVE-2017-18466 | Low | 2.7 | 2019-08-05 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
CVE-2017-18465 | Medium | 4.4 | 2019-08-05 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). |
CVE-2017-18464 | Medium | 4.9 | 2019-08-05 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
CVE-2019-7899 | Medium | 5.3 | 2019-08-02 | Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Comm… |
CVE-2019-7898 | Medium | 5.3 | 2019-08-02 | Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… |
CVE-2019-7885 | High | 8.8 | 2019-08-02 | Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2… |
CVE-2017-18463 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
CVE-2017-18461 | Medium | 4.3 | 2019-08-02 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
CVE-2017-18460 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
CVE-2017-18459 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
CVE-2017-18458 | Low | 3.3 | 2019-08-02 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
CVE-2017-18453 | Medium | 4.9 | 2019-08-02 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
CVE-2017-18452 | Medium | 6.7 | 2019-08-02 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
CVE-2017-18449 | Medium | 5.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |
CVE-2017-18447 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). |
CVE-2017-18444 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). |
CVE-2017-18443 | Medium | 5.8 | 2019-08-02 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). |
CVE-2017-18440 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). |
CVE-2017-18439 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). |
CVE-2019-9141 | Critical | 9.8 | 2019-08-02 | ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting t… |
CVE-2017-18434 | High | 7.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
CVE-2017-18433 | High | 8.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). |
CVE-2017-18431 | High | 7.5 | 2019-08-02 | cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). |
CVE-2017-18430 | Medium | 4.7 | 2019-08-02 | In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). |
CVE-2017-18415 | High | 7.8 | 2019-08-02 | cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). |
CVE-2017-18411 | Medium | 6.8 | 2019-08-02 | The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). |
CVE-2017-18410 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). |
CVE-2017-18409 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). |