CWE-20 · Improper Input Validation (page 65)
Page 65 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1694 | High | 8.6 | 2019-05-03 | A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2019-1687 | High | 7.5 | 2019-05-03 | A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could all… |
CVE-2019-1682 | High | 7.8 | 2019-05-03 | A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an authenticated, local… |
CVE-2019-1592 | High | 7.8 | 2019-05-03 | A vulnerability in the background operations functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow… |
CVE-2019-1587 | Medium | 4.3 | 2019-05-03 | A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, remote attacker to ac… |
CVE-2019-11687 | High | 7.8 | 2019-05-02 | An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte… |
CVE-2019-9826 | High | 7.5 | 2019-05-02 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service. |
CVE-2018-2015 | Medium | 6.4 | 2019-05-02 | IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2018-20835 | High | 7.5 | 2019-04-30 | A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that alre… |
CVE-2019-11595 | Critical | 9.0 | 2019-04-29 | In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a… |
CVE-2019-9807 | Medium | 4.3 | 2019-04-26 | When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content… |
CVE-2019-9801 | Medium | 5.3 | 2019-04-26 | Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows o… |
CVE-2019-9799 | High | 7.5 | 2019-04-26 | Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent pro… |
CVE-2018-15003 | High | 7.5 | 2019-04-25 | The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy:7.1.1/143.14.171129… |
CVE-2018-14994 | High | 7.5 | 2019-04-25 | The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys contains a pre-installed platfor… |
CVE-2018-14991 | Critical | 9.8 | 2019-04-25 | The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerpr… |
CVE-2018-14990 | High | 7.5 | 2019-04-25 | The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerpr… |
CVE-2018-14989 | High | 7.5 | 2019-04-25 | The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed pl… |
CVE-2018-14983 | Medium | 5.5 | 2019-04-25 | The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework (i.e… |
CVE-2018-20823 | High | 7.5 | 2019-04-25 | The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal, aka a MEMS ultrasou… |
CVE-2017-18367 | High | 7.5 | 2019-04-24 | libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccom… |
CVE-2019-11218 | High | 8.8 | 2019-04-24 | Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated user… |
CVE-2018-7577 | High | 8.1 | 2019-04-24 | Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process… |
CVE-2019-11460 | Critical | 9.0 | 2019-04-22 | An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bub… |
CVE-2016-1586 | Low | 1.8 | 2019-04-22 | A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before… |
CVE-2015-1326 | Medium | 5.7 | 2019-04-22 | python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious… |
CVE-2014-1426 | High | 8.6 | 2019-04-22 | A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS… |
CVE-2019-11417 | Critical | 9.8 | 2019-04-22 | system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp functio… |
CVE-2019-2028 | High | 8.8 | 2019-04-19 | In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. This could lead to remote code execution with no additional execution privile… |
CVE-2019-11340 | Medium | 5.9 | 2019-04-19 | util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is ena… |
CVE-2019-10245 | High | 7.5 | 2019-04-19 | In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes… |
CVE-2019-1841 | Medium | 6.5 | 2019-04-18 | A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services witho… |
CVE-2019-1837 | Medium | 5.3 | 2019-04-18 | A vulnerability in the User Data Services (UDS) API of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to cau… |
CVE-2019-1834 | High | 7.4 | 2019-04-18 | A vulnerability in the internal packet processing of Cisco Aironet Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a deni… |
CVE-2019-1831 | Medium | 5.8 | 2019-04-18 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2019-1830 | Medium | 4.9 | 2019-04-18 | A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated, remote attacker t… |
CVE-2019-1826 | Medium | 6.8 | 2019-04-18 | A vulnerability in the quality of service (QoS) feature of Cisco Aironet Series Access Points (APs) could allow an authenticated, adjacent attacker to cause a… |
CVE-2019-1805 | Medium | 4.3 | 2019-04-18 | A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could al… |
CVE-2019-1800 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1799 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1796 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1721 | Medium | 6.5 | 2019-04-18 | A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remo… |
CVE-2019-1720 | Medium | 6.8 | 2019-04-18 | A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker… |
CVE-2019-1712 | Medium | 5.8 | 2019-04-17 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the PIM p… |
CVE-2019-1711 | Medium | 5.3 | 2019-04-17 | A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of ser… |
CVE-2019-1710 | Critical | 9.8 | 2019-04-17 | A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an… |
CVE-2018-0248 | Medium | 6.8 | 2019-04-17 | A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an aUTHENTICated, remote attacker t… |
CVE-2019-0163 | High | 8.2 | 2019-04-17 | Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated user to potentially en… |
CVE-2018-4007 | High | 7.1 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. The program is able to dele… |
CVE-2018-4006 | High | 7.8 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. A non-root user is able to w… |
CVE-2018-4005 | High | 7.8 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function. A user with local… |
CVE-2018-4004 | Medium | 5.5 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality. A non-root user is abl… |
CVE-2018-16561 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could… |
CVE-2018-16559 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted n… |
CVE-2018-16558 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted n… |
CVE-2019-9845 | Critical | 9.8 | 2019-04-16 | madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesTo… |
CVE-2019-11228 | High | 7.5 | 2019-04-15 | repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. |
CVE-2018-20487 | High | 8.8 | 2019-04-11 | An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as a… |
CVE-2019-3460 | Medium | 6.5 | 2019-04-11 | A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1. |
CVE-2018-19300 | Critical | 9.8 | 2019-04-11 | On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (… |
CVE-2019-11071 | High | 8.8 | 2019-04-10 | SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled. |
CVE-2019-11069 | High | 7.5 | 2019-04-10 | Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. |
CVE-2019-0786 | Critical | 9.8 | 2019-04-09 | An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a sp… |
CVE-2019-0768 | Medium | 4.3 | 2019-04-09 | A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions… |
CVE-2019-0701 | Medium | 6.8 | 2019-04-09 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0695 | Medium | 6.8 | 2019-04-09 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0690 | Medium | 6.8 | 2019-04-09 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-1798 | Medium | 5.5 | 2019-04-08 | A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unaut… |
CVE-2019-1788 | Medium | 5.5 | 2019-04-08 | A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow… |
CVE-2019-11014 | Critical | 9.8 | 2019-04-08 | The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing o… |
CVE-2019-1787 | Medium | 5.5 | 2019-04-08 | A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unau… |
CVE-2019-1786 | Medium | 5.5 | 2019-04-08 | A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an un… |
CVE-2019-1785 | High | 7.8 | 2019-04-08 | A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote… |
CVE-2014-9186 | Critical | 9.8 | 2019-04-08 | A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which c… |
CVE-2018-11966 | High | 7.8 | 2019-04-04 | Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT… |
CVE-2018-11830 | High | 7.8 | 2019-04-04 | Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Ind… |
CVE-2015-5606 | High | 7.5 | 2019-04-03 | Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request. |
CVE-2018-4462 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4460 | Medium | 6.5 | 2019-04-03 | A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, w… |
CVE-2018-4446 | Low | 3.3 | 2019-04-03 | This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.1.1. |
CVE-2018-4440 | Medium | 4.3 | 2019-04-03 | A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud… |
CVE-2018-4439 | Medium | 6.5 | 2019-04-03 | A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Wi… |
CVE-2018-4435 | High | 7.8 | 2019-04-03 | A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. |
CVE-2018-4429 | Medium | 6.5 | 2019-04-03 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, wa… |
CVE-2018-4423 | High | 7.8 | 2019-04-03 | A logic issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4418 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4417 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4406 | Medium | 6.5 | 2019-04-03 | A denial of service issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4400 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved logic. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, watchOS 5.1. |
CVE-2018-4399 | Medium | 5.5 | 2019-04-03 | An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS M… |
CVE-2018-4398 | High | 7.5 | 2019-04-03 | An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes. This issue affected v… |
CVE-2018-4397 | Medium | 4.3 | 2019-04-03 | Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Sup… |
CVE-2018-4396 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4395 | Medium | 5.5 | 2019-04-03 | This issue was addressed with improved checks. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4389 | Medium | 6.5 | 2019-04-03 | An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4385 | Medium | 6.5 | 2019-04-03 | A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1. |
CVE-2018-4369 | High | 7.5 | 2019-04-03 | A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1. |
CVE-2018-4368 | Medium | 6.5 | 2019-04-03 | A denial of service issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1. |
CVE-2018-4363 | Medium | 5.5 | 2019-04-03 | An input validation issue existed in the kernel. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12, tvOS 12… |
CVE-2018-4362 | Medium | 6.5 | 2019-04-03 | An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2, iOS 12. |