CWE-20 · Improper Input Validation (page 64)
Page 64 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16064 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2017-5028 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-10134 | Low | 3.7 | 2019-06-26 | A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their q… |
CVE-2019-12981 | High | 8.8 | 2019-06-26 | Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c. |
CVE-2018-20846 | Medium | 6.5 | 2019-06-26 | Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG thro… |
CVE-2019-9085 | Medium | 6.5 | 2019-06-24 | Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contra… |
CVE-2019-12936 | High | 7.1 | 2019-06-23 | BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions. |
CVE-2018-15735 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the outpu… |
CVE-2018-15734 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the outpu… |
CVE-2018-15732 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the outpu… |
CVE-2018-15731 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the outp… |
CVE-2018-15730 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the outp… |
CVE-2018-15729 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the outp… |
CVE-2018-15747 | Critical | 9.8 | 2019-06-21 | The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a… |
CVE-2018-15737 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the outp… |
CVE-2018-15736 | Medium | 5.5 | 2019-06-21 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the outp… |
CVE-2019-1906 | Medium | 6.5 | 2019-06-20 | A vulnerability in the Virtual Domain system of Cisco Prime Infrastructure (PI) could allow an authenticated, remote attacker to change the virtual domain conf… |
CVE-2019-1905 | Medium | 5.8 | 2019-06-20 | A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote atta… |
CVE-2019-1875 | Medium | 4.8 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scri… |
CVE-2019-1843 | High | 8.6 | 2019-06-20 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2019-2016 | High | 8.8 | 2019-06-19 | In NFA_SendRawFrame of nfa_dm_api.cc, there is a possible out-of-bound write due to improper input validation. This could lead to local escalation of privilege… |
CVE-2017-8330 | Medium | 6.5 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a UPnP functionality for devices to int… |
CVE-2018-18878 | High | 7.5 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to sen… |
CVE-2018-20013 | High | 7.5 | 2019-06-18 | In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::Proce… |
CVE-2019-12831 | High | 7.2 | 2019-06-15 | In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database… |
CVE-2019-12816 | High | 8.8 | 2019-06-15 | Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a cr… |
CVE-2018-13906 | Critical | 9.1 | 2019-06-14 | The HMAC authenticating the message from QSEE is vulnerable to timing side channel analysis leading to potentially forged application message in Snapdragon Aut… |
CVE-2018-10947 | Low | 3.1 | 2019-06-13 | An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset only after a Debut is rebooted. |
CVE-2019-11128 | Medium | 6.7 | 2019-06-13 | Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of serv… |
CVE-2019-11125 | Medium | 6.7 | 2019-06-13 | Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of serv… |
CVE-2019-11123 | Medium | 6.7 | 2019-06-13 | Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of se… |
CVE-2019-0157 | Medium | 5.5 | 2019-06-13 | Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access. |
CVE-2018-12147 | Medium | 6.7 | 2019-06-13 | Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted… |
CVE-2019-0973 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr… |
CVE-2019-0722 | High | 8.8 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0713 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0711 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0710 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0709 | High | 7.6 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0620 | High | 7.6 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-3957 | High | 7.4 | 2019-06-07 | Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSigna… |
CVE-2019-3956 | High | 7.4 | 2019-06-07 | Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPub… |
CVE-2019-3723 | Critical | 9.1 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauth… |
CVE-2018-9839 | Medium | 6.5 | 2019-06-06 | An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with R… |
CVE-2019-1861 | High | 7.2 | 2019-06-05 | A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. Th… |
CVE-2019-1845 | High | 8.6 | 2019-06-05 | A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Vid… |
CVE-2019-11980 | High | 8.8 | 2019-06-05 | A remote code exection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11968 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11967 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2017-6261 | High | 8.2 | 2019-06-05 | NVIDIA Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to… |
CVE-2019-5285 | High | 7.5 | 2019-06-04 | Some Huawei S series switches have a DoS vulnerability. An unauthenticated remote attacker can send crafted packets to the affected device to exploit this vuln… |
CVE-2019-5244 | Medium | 5.5 | 2019-06-04 | Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An att… |
CVE-2019-5678 | High | 7.8 | 2019-05-31 | NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attacker with local system access can craft… |
CVE-2019-9221 | Medium | 5.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-12439 | High | 7.4 | 2019-05-29 | bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR)… |
CVE-2019-2250 | High | 7.8 | 2019-05-24 | Kernel can write to arbitrary memory address passed by user while freeing/stopping a thread in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industri… |
CVE-2019-5803 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy v… |
CVE-2019-5801 | Medium | 6.5 | 2019-05-23 | Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-5800 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2019-5799 | Medium | 6.5 | 2019-05-23 | Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content… |
CVE-2019-5793 | Medium | 6.5 | 2019-05-23 | Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user int… |
CVE-2017-11740 | High | 8.8 | 2019-05-23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occur… |
CVE-2017-5211 | High | 7.5 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2017-8341 | Medium | 5.3 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2018-14729 | High | 8.8 | 2019-05-22 | The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code. |
CVE-2018-12270 | Medium | 5.4 | 2019-05-20 | In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting… |
CVE-2019-5931 | High | 8.7 | 2019-05-17 | Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors. |
CVE-2019-11114 | Medium | 4.4 | 2019-05-17 | Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable denial of s… |
CVE-2019-11094 | High | 7.8 | 2019-05-17 | Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of… |
CVE-2019-11085 | High | 7.8 | 2019-05-17 | Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enabl… |
CVE-2019-0115 | Medium | 5.5 | 2019-05-17 | Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) m… |
CVE-2019-0097 | Medium | 4.9 | 2019-05-17 | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of se… |
CVE-2019-0094 | Medium | 4.3 | 2019-05-17 | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated use… |
CVE-2019-0092 | Medium | 6.8 | 2019-05-17 | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated use… |
CVE-2019-0957 | High | 8.8 | 2019-05-16 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2019-0886 | Medium | 6.8 | 2019-05-16 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2019-0885 | High | 7.8 | 2019-05-16 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabi… |
CVE-2019-1858 | High | 8.6 | 2019-05-16 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthen… |
CVE-2019-1846 | High | 7.4 | 2019-05-16 | A vulnerability in the Multiprotocol Label Switching (MPLS) Operations, Administration, and Maintenance (OAM) implementation of Cisco IOS XR Software for Cisco… |
CVE-2019-1823 | High | 8.8 | 2019-05-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an au… |
CVE-2019-1822 | High | 7.2 | 2019-05-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an au… |
CVE-2019-1821 | High | 8.8 | 2019-05-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an au… |
CVE-2019-1806 | High | 7.7 | 2019-05-15 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switch… |
CVE-2019-1729 | Medium | 6.0 | 2019-05-15 | A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacke… |
CVE-2019-1726 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an aff… |
CVE-2019-5598 | High | 7.5 | 2019-05-15 | In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in… |
CVE-2019-5597 | Critical | 9.1 | 2019-05-15 | In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6… |
CVE-2019-1862 | High | 7.2 | 2019-05-13 | A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the unde… |
CVE-2018-18558 | Medium | 6.4 | 2019-05-13 | An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader… |
CVE-2017-12795 | Critical | 9.8 | 2019-05-10 | OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). |
CVE-2019-9847 | High | 7.8 | 2019-05-09 | A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable o… |
CVE-2019-11832 | High | 7.5 | 2019-05-09 | TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as… |
CVE-2019-2051 | High | 7.5 | 2019-05-08 | In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure when processing… |
CVE-2018-6243 | High | 7.8 | 2019-05-07 | NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of video metadata count may lead to Arbitrar… |
CVE-2019-7443 | High | 8.1 | 2019-05-07 | KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cau… |
CVE-2018-20580 | High | 8.8 | 2019-05-03 | The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a… |
CVE-2019-1844 | Medium | 5.3 | 2019-05-03 | A vulnerability in certain attachment detection mechanisms of the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypas… |
CVE-2019-1817 | High | 7.5 | 2019-05-03 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an unauthenticated, remote attacker to ca… |
CVE-2019-1816 | High | 7.8 | 2019-05-03 | A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command inj… |
CVE-2019-1697 | Medium | 6.8 | 2019-05-03 | A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firep… |