CWE-20 · Improper Input Validation (page 67)
Page 67 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1945 | Medium | 6.1 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the vict… |
CVE-2019-8954 | High | 8.8 | 2019-02-20 | In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the… |
CVE-2019-5783 | High | 8.8 | 2019-02-19 | Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection att… |
CVE-2019-5780 | High | 7.8 | 2019-02-19 | Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript… |
CVE-2019-5769 | High | 8.8 | 2019-02-19 | Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentia… |
CVE-2018-20782 | High | 7.5 | 2019-02-17 | The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages. |
CVE-2019-0255 | High | 8.1 | 2019-02-15 | SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system… |
CVE-2018-6267 | High | 7.8 | 2019-02-13 | NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software does not validate or incorrectly validates input that can affect the cont… |
CVE-2018-19008 | High | 7.8 | 2019-02-13 | The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wherein the applicati… |
CVE-2017-0938 | High | 7.5 | 2019-02-12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. |
CVE-2018-5499 | High | 7.5 | 2019-02-12 | ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS). |
CVE-2018-12549 | Critical | 9.8 | 2019-02-11 | In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it. |
CVE-2018-12547 | Critical | 9.8 | 2019-02-11 | In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs… |
CVE-2018-11847 | High | 7.8 | 2019-02-11 | Malicious TA can tag QSEE kernel memory and map to EL0, there by corrupting the physical memory as well it can be used to corrupt the QSEE kernel and compromis… |
CVE-2018-20771 | Critical | 9.8 | 2019-02-10 | An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic… |
CVE-2018-20767 | High | 8.8 | 2019-02-10 | An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic… |
CVE-2019-1676 | Medium | 6.8 | 2019-02-08 | A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated, remote attacker… |
CVE-2019-1680 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability… |
CVE-2019-1678 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application… |
CVE-2019-7412 | Critical | 9.8 | 2019-02-05 | The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. |
CVE-2018-15778 | High | 8.8 | 2019-02-04 | Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-line interface (CLI). |
CVE-2018-18988 | High | 8.8 | 2019-02-01 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code exe… |
CVE-2018-5498 | Medium | 4.4 | 2019-02-01 | Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Denial of Service (DoS)… |
CVE-2018-6241 | High | 7.8 | 2019-01-31 | NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the registerbuffer API, which may lead to arbit… |
CVE-2018-15136 | Medium | 5.3 | 2019-01-30 | TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entir… |
CVE-2018-19010 | Medium | 6.5 | 2019-01-28 | Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-20743 | High | 7.5 | 2019-01-25 | murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to… |
CVE-2017-18359 | High | 7.5 | 2019-01-25 | PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by… |
CVE-2019-1656 | Medium | 5.3 | 2019-01-24 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to access the shell of the unde… |
CVE-2019-1652 | High | 7.2 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote… |
CVE-2019-1650 | High | 8.8 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2019-1648 | High | 7.8 | 2019-01-24 | A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an aff… |
CVE-2017-15720 | High | 8.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. |
CVE-2019-6339 | Critical | 9.8 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar s… |
CVE-2016-10739 | Medium | 5.3 | 2019-01-21 | In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by w… |
CVE-2018-5869 | High | 7.8 | 2019-01-18 | Improper input validation in the QTEE keymaster app can lead to invalid memory access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MS… |
CVE-2018-11999 | Medium | 5.5 | 2019-01-18 | Improper input validation in trustzone can lead to denial of service in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM96… |
CVE-2017-3142 | Medium | 5.3 | 2019-01-16 | An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TS… |
CVE-2018-20720 | High | 7.5 | 2019-01-16 | ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reb… |
CVE-2017-6921 | Medium | 5.9 | 2019-01-15 | In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site… |
CVE-2018-4277 | High | 7.5 | 2019-01-11 | In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handlin… |
CVE-2018-4254 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, an input validation issue existed in the kernel. This issue was addressed with improved input validation. |
CVE-2018-4213 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4209 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4208 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4207 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2017-13891 | Medium | 6.5 | 2019-01-11 | In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management. |
CVE-2018-15460 | High | 8.6 | 2019-01-10 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remo… |
CVE-2018-20684 | High | 7.5 | 2019-01-10 | In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelate… |
CVE-2017-1002157 | Critical | 9.8 | 2019-01-10 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. |
CVE-2018-12167 | Medium | 4.4 | 2019-01-10 | Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial… |
CVE-2018-12166 | Medium | 4.4 | 2019-01-10 | Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a den… |
CVE-2018-15453 | High | 8.6 | 2019-01-10 | A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco Asyn… |
CVE-2018-4047 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4046 | Medium | 5.5 | 2019-01-10 | An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with loca… |
CVE-2018-4045 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4044 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4043 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with loca… |
CVE-2018-4042 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4041 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4037 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access can use th… |
CVE-2018-4036 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4035 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4034 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4033 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4032 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could… |
CVE-2018-20683 | High | 8.1 | 2019-01-10 | commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by tr… |
CVE-2018-16196 | High | 7.5 | 2019-01-09 | Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50)… |
CVE-2018-16185 | High | 7.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-6169 | Medium | 6.5 | 2019-01-09 | Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwant… |
CVE-2018-6160 | Medium | 6.5 | 2019-01-09 | JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6140 | High | 8.8 | 2019-01-09 | Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to insta… |
CVE-2018-6139 | High | 8.8 | 2019-01-09 | Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a… |
CVE-2018-6114 | Medium | 6.5 | 2019-01-09 | Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via… |
CVE-2018-6113 | Medium | 6.5 | 2019-01-09 | Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofi… |
CVE-2018-6111 | High | 8.8 | 2019-01-09 | An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-6110 | Medium | 5.4 | 2019-01-09 | Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTM… |
CVE-2018-6096 | Medium | 6.5 | 2019-01-09 | A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscur… |
CVE-2018-6084 | High | 7.8 | 2019-01-09 | Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-20070 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omni… |
CVE-2018-20068 | Medium | 4.3 | 2019-01-09 | Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of t… |
CVE-2018-20065 | High | 8.8 | 2019-01-09 | Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user ges… |
CVE-2018-16088 | Medium | 6.5 | 2019-01-09 | A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no use… |
CVE-2018-16080 | Medium | 6.5 | 2019-01-09 | A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the… |
CVE-2018-16068 | Critical | 9.6 | 2019-01-09 | Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2017-15402 | Critical | 9.6 | 2019-01-09 | Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navig… |
CVE-2019-3581 | High | 7.5 | 2019-01-09 | Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTT… |
CVE-2019-5717 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid… |
CVE-2019-5716 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its crea… |
CVE-2019-0551 | High | 8.4 | 2019-01-08 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0550 | High | 8.4 | 2019-01-08 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2017-18320 | High | 7.8 | 2019-01-03 | QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in versions MSM8996AU… |
CVE-2018-20662 | Medium | 6.5 | 2019-01-03 | In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong r… |
CVE-2018-19478 | Medium | 5.5 | 2019-01-02 | In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computation when parsing the file. |
CVE-2018-20658 | High | 7.5 | 2019-01-02 | The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command. |
CVE-2018-5197 | High | 7.8 | 2019-01-02 | A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a command injection a… |
CVE-2018-20650 | Medium | 6.5 | 2019-01-01 | A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as… |
CVE-2018-6333 | Critical | 9.8 | 2018-12-31 | The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be us… |
CVE-2018-6347 | High | 7.5 | 2018-12-31 | An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00. |