CWE-20 · Improper Input Validation (page 63)
Page 63 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18452 | Medium | 6.7 | 2019-08-02 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
CVE-2017-18449 | Medium | 5.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |
CVE-2017-18447 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). |
CVE-2017-18444 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). |
CVE-2017-18443 | Medium | 5.8 | 2019-08-02 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). |
CVE-2017-18440 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). |
CVE-2017-18439 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). |
CVE-2019-9141 | Critical | 9.8 | 2019-08-02 | ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting t… |
CVE-2017-18434 | High | 7.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
CVE-2017-18433 | High | 8.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). |
CVE-2017-18431 | High | 7.5 | 2019-08-02 | cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). |
CVE-2017-18430 | Medium | 4.7 | 2019-08-02 | In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). |
CVE-2017-18415 | High | 7.8 | 2019-08-02 | cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). |
CVE-2017-18411 | Medium | 6.8 | 2019-08-02 | The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). |
CVE-2017-18410 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). |
CVE-2017-18409 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). |
CVE-2017-18405 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). |
CVE-2017-18401 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). |
CVE-2017-18398 | Low | 3.8 | 2019-08-02 | DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). |
CVE-2017-18395 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of ssl (SEC-328). |
CVE-2017-18394 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). |
CVE-2017-18393 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). |
CVE-2017-18392 | Low | 2.0 | 2019-08-02 | cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). |
CVE-2017-18388 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). |
CVE-2017-18382 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
CVE-2016-10816 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). |
CVE-2016-10814 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). |
CVE-2016-10824 | Critical | 9.8 | 2019-08-01 | cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). |
CVE-2016-10823 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). |
CVE-2016-10842 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74). |
CVE-2018-20917 | Medium | 5.5 | 2019-08-01 | cPanel before 70.0.23 allows any user to disable Solr (SEC-371). |
CVE-2018-20912 | Medium | 6.3 | 2019-08-01 | cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). |
CVE-2016-10858 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). |
CVE-2016-10855 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91). |
CVE-2016-10850 | High | 8.8 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). |
CVE-2018-20897 | Low | 2.8 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). |
CVE-2018-20895 | High | 7.2 | 2019-08-01 | In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393). |
CVE-2018-20893 | Low | 2.3 | 2019-08-01 | cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442). |
CVE-2018-20891 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436). |
CVE-2018-10899 | High | 8.1 | 2019-08-01 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured… |
CVE-2015-7559 | Low | 2.7 | 2019-08-01 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a comprom… |
CVE-2018-20883 | Medium | 6.5 | 2019-08-01 | cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). |
CVE-2018-20882 | Medium | 6.8 | 2019-08-01 | cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447). |
CVE-2018-20879 | Medium | 6.3 | 2019-08-01 | cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). |
CVE-2018-20873 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409). |
CVE-2007-6763 | High | 8.8 | 2019-07-31 | SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back… |
CVE-2018-20861 | Medium | 6.5 | 2019-07-30 | libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files. |
CVE-2018-20860 | Medium | 6.5 | 2019-07-30 | libopenmpt before 0.3.13 allows a crash with malformed MED files. |
CVE-2018-20869 | High | 7.8 | 2019-07-30 | cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). |
CVE-2018-20864 | Medium | 6.5 | 2019-07-30 | cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). |
CVE-2018-20863 | Critical | 9.8 | 2019-07-30 | cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). |
CVE-2018-11773 | Critical | 9.8 | 2019-07-29 | Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument… |
CVE-2016-10765 | Medium | 5.3 | 2019-07-29 | edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address. |
CVE-2018-20857 | High | 7.5 | 2019-07-26 | Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain… |
CVE-2019-2330 | Medium | 5.5 | 2019-07-25 | improper input validation in allocation request for secure allocations can lead to page fault. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-14243 | High | 7.5 | 2019-07-23 | headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attac… |
CVE-2019-11716 | High | 8.3 | 2019-07-23 | Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). S… |
CVE-2019-11714 | Critical | 9.8 | 2019-07-23 | Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vulnerability affects… |
CVE-2019-11708 | Critical | 10.0 | 2019-07-23 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
CVE-2019-11698 | Medium | 5.3 | 2019-07-23 | If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web conten… |
CVE-2019-11697 | Medium | 6.5 | 2019-07-23 | If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that… |
CVE-2019-11696 | High | 7.8 | 2019-07-23 | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be execut… |
CVE-2019-13097 | High | 7.5 | 2019-07-22 | The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually… |
CVE-2019-1010234 | Critical | 9.8 | 2019-07-22 | The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending… |
CVE-2019-14211 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the lack of proper validation of the existence of an object prior… |
CVE-2019-5680 | Medium | 6.7 | 2019-07-19 | In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu image is loaded witho… |
CVE-2019-1010245 | Critical | 9.8 | 2019-07-19 | The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbi… |
CVE-2019-7843 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Inf… |
CVE-2019-1010252 | Medium | 4.9 | 2019-07-18 | The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended… |
CVE-2019-1010251 | High | 7.5 | 2019-07-18 | Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can e… |
CVE-2019-1010250 | Medium | 4.9 | 2019-07-18 | The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended… |
CVE-2019-1923 | Medium | 6.6 | 2019-07-17 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-1920 | High | 7.4 | 2019-07-17 | A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker… |
CVE-2019-3571 | Medium | 5.3 | 2019-07-16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed wi… |
CVE-2019-10191 | High | 7.5 | 2019-07-16 | A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC… |
CVE-2019-10190 | High | 7.5 | 2019-07-16 | A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC val… |
CVE-2018-19629 | High | 7.5 | 2019-07-16 | A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a… |
CVE-2019-13612 | High | 7.5 | 2019-07-16 | MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special… |
CVE-2019-1113 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2019-1109 | Critical | 9.1 | 2019-07-15 | A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker w… |
CVE-2019-1079 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclos… |
CVE-2019-1072 | Critical | 9.8 | 2019-07-15 | A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server a… |
CVE-2019-0966 | Medium | 6.8 | 2019-07-15 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-1010295 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: op… |
CVE-2018-20852 | Medium | 5.3 | 2019-07-13 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into se… |
CVE-2014-3798 | Medium | 6.5 | 2019-07-11 | The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a crafted Ethernet fr… |
CVE-2019-1873 | High | 8.6 | 2019-07-10 | A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an una… |
CVE-2018-19580 | Medium | 5.3 | 2019-07-10 | All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made. |
CVE-2018-10531 | High | 7.5 | 2019-07-10 | An issue was discovered in the America's Army Proving Grounds platform for the Unreal Engine. With a false packet sent via UDP, the application server responds… |
CVE-2017-7189 | High | 7.5 | 2019-07-10 | main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port… |
CVE-2017-12652 | Critical | 9.8 | 2019-07-10 | libpng before 1.6.32 does not properly check the length of chunks against the user limit. |
CVE-2018-15738 | Medium | 5.5 | 2019-07-09 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the outpu… |
CVE-2019-13449 | Medium | 6.5 | 2019-07-09 | In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&c… |
CVE-2019-10973 | High | 7.2 | 2019-07-08 | Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting too… |
CVE-2019-1933 | Medium | 5.8 | 2019-07-06 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2019-1921 | Medium | 5.8 | 2019-07-06 | A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker t… |
CVE-2019-1909 | Medium | 6.8 | 2019-07-06 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker t… |
CVE-2019-1894 | High | 7.2 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrit… |
CVE-2019-1891 | High | 7.5 | 2019-07-06 | A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause… |
CVE-2018-14733 | High | 7.5 | 2019-07-05 | The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service)… |