CWE-20 · Improper Input Validation (page 66)
Page 66 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1968 | High | 7.5 | 2019-08-30 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2019-14979 | Medium | 5.3 | 2019-08-29 | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such… |
CVE-2019-14978 | Medium | 5.3 | 2019-08-29 | /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as… |
CVE-2019-11247 | High | 8.1 | 2019-08-29 | The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authoriza… |
CVE-2019-10054 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access… |
CVE-2019-1964 | High | 8.6 | 2019-08-28 | A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the ne… |
CVE-2019-1963 | High | 7.7 | 2019-08-28 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenti… |
CVE-2019-1962 | High | 8.6 | 2019-08-28 | A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause process crashes, which… |
CVE-2019-13270 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order… |
CVE-2019-13269 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R… |
CVE-2019-13268 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2015-9351 | Critical | 9.8 | 2019-08-27 | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. |
CVE-2015-9348 | High | 7.5 | 2019-08-27 | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. |
CVE-2015-9345 | High | 7.5 | 2019-08-27 | The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. |
CVE-2017-18589 | High | 7.5 | 2019-08-26 | An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic. |
CVE-2019-15640 | High | 7.5 | 2019-08-26 | Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image. |
CVE-2019-12400 | Medium | 5.5 | 2019-08-23 | In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of Docum… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2013-7483 | Critical | 9.8 | 2019-08-22 | The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. |
CVE-2016-10930 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. |
CVE-2019-7617 | High | 7.2 | 2019-08-22 | When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the pr… |
CVE-2019-15324 | High | 8.8 | 2019-08-22 | The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. |
CVE-2018-20985 | Critical | 9.8 | 2019-08-22 | The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. |
CVE-2017-18580 | Critical | 9.8 | 2019-08-22 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. |
CVE-2014-10384 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. |
CVE-2014-10383 | Critical | 9.8 | 2019-08-22 | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. |
CVE-2018-20981 | Critical | 9.1 | 2019-08-22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. |
CVE-2018-20980 | High | 7.5 | 2019-08-22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. |
CVE-2017-18574 | Medium | 6.1 | 2019-08-22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. |
CVE-2009-5158 | Medium | 6.1 | 2019-08-22 | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. |
CVE-2019-1984 | Medium | 6.5 | 2019-08-21 | A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with adminis… |
CVE-2019-1936 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1839 | Medium | 6.7 | 2019-08-21 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-12626 | Medium | 4.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to co… |
CVE-2016-10899 | Medium | 5.3 | 2019-08-21 | The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. |
CVE-2019-2136 | Medium | 5.5 | 2019-08-20 | In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosu… |
CVE-2019-11140 | Medium | 6.7 | 2019-08-19 | Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of servic… |
CVE-2018-20973 | Critical | 9.8 | 2019-08-16 | The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. |
CVE-2017-18545 | High | 7.5 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. |
CVE-2019-7959 | Critical | 9.8 | 2019-08-16 | Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could l… |
CVE-2019-9851 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2019-9850 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2018-14671 | Critical | 9.8 | 2019-08-15 | In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability. |
CVE-2019-1204 | Medium | 4.3 | 2019-08-14 | An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting… |
CVE-2019-0965 | High | 7.6 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0723 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0720 | High | 8.0 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o… |
CVE-2019-0718 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0717 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0715 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0714 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2017-18509 | High | 7.8 | 2019-08-13 | An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel l… |
CVE-2019-1971 | Critical | 9.8 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command… |
CVE-2019-1961 | Medium | 4.9 | 2019-08-08 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying… |
CVE-2019-1960 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1959 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1955 | High | 7.5 | 2019-08-08 | A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthent… |
CVE-2019-1954 | Medium | 6.1 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a use… |
CVE-2019-1952 | Medium | 6.7 | 2019-08-08 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary… |
CVE-2019-1951 | Medium | 5.8 | 2019-08-08 | A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters… |
CVE-2019-14771 | Critical | 9.8 | 2019-08-08 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line… |
CVE-2019-1945 | Medium | 6.7 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1944 | High | 7.3 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1918 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR So… |
CVE-2019-1910 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS X… |
CVE-2019-14474 | High | 7.5 | 2019-08-07 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial… |
CVE-2016-10812 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). |
CVE-2016-10808 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). |
CVE-2016-10807 | Medium | 6.5 | 2019-08-07 | cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). |
CVE-2016-10805 | High | 8.8 | 2019-08-07 | cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109). |
CVE-2016-10804 | High | 8.1 | 2019-08-07 | The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). |
CVE-2016-10800 | High | 7.8 | 2019-08-07 | cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). |
CVE-2019-1914 | High | 7.2 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a co… |
CVE-2019-13143 | Critical | 9.8 | 2019-08-06 | An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the… |
CVE-2016-10793 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152). |
CVE-2016-10789 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191). |
CVE-2016-10788 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188). |
CVE-2016-10787 | High | 8.1 | 2019-08-06 | The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187). |
CVE-2019-14671 | Low | 3.3 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as fo… |
CVE-2017-18482 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). |
CVE-2017-18475 | High | 8.8 | 2019-08-05 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). |
CVE-2017-18469 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). |
CVE-2016-10775 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). |
CVE-2016-10771 | High | 8.1 | 2019-08-05 | cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). |
CVE-2016-10770 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). |
CVE-2016-10768 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). |
CVE-2017-18466 | Low | 2.7 | 2019-08-05 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
CVE-2017-18465 | Medium | 4.4 | 2019-08-05 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). |
CVE-2017-18464 | Medium | 4.9 | 2019-08-05 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
CVE-2019-7899 | Medium | 5.3 | 2019-08-02 | Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Comm… |
CVE-2019-7898 | Medium | 5.3 | 2019-08-02 | Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… |
CVE-2019-7885 | High | 8.8 | 2019-08-02 | Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2… |
CVE-2017-18463 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
CVE-2017-18461 | Medium | 4.3 | 2019-08-02 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
CVE-2017-18460 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
CVE-2017-18459 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
CVE-2017-18458 | Low | 3.3 | 2019-08-02 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
CVE-2017-18453 | Medium | 4.9 | 2019-08-02 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
CVE-2017-18452 | Medium | 6.7 | 2019-08-02 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
CVE-2017-18449 | Medium | 5.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |