CWE-20 · Improper Input Validation (page 69)
Page 69 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15324 | Medium | 5.9 | 2018-10-31 | On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. |
CVE-2018-15323 | Medium | 5.9 | 2018-10-31 | On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the T… |
CVE-2018-15319 | High | 7.5 | 2018-10-31 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. T… |
CVE-2018-15318 | High | 7.5 | 2018-10-31 | In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary f… |
CVE-2018-16469 | High | 7.5 | 2018-10-30 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be p… |
CVE-2018-10711 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2015-5159 | High | 7.5 | 2018-10-30 | python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request. |
CVE-2018-11873 | High | 7.8 | 2018-10-29 | Improper input validation leads to buffer overwrite in the WLAN function that handles WLAN roam buffer in Snapdragon Mobile in version SD 845. |
CVE-2018-11872 | High | 7.8 | 2018-10-29 | Improper input validation leads to buffer overwrite in the WLAN function that handles WMI commands in Snapdragon Mobile in version SD 845, SD 850, SDA660 |
CVE-2018-11950 | High | 7.8 | 2018-10-26 | Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850 |
CVE-2018-7432 | High | 7.5 | 2018-10-23 | Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to… |
CVE-2018-7429 | High | 7.5 | 2018-10-23 | Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote attackers to cause a d… |
CVE-2018-14820 | High | 7.5 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbit… |
CVE-2017-18349 | Critical | 9.8 | 2018-10-23 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a cr… |
CVE-2017-18292 | Medium | 5.5 | 2018-10-23 | Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in… |
CVE-2018-13115 | Medium | 6.5 | 2018-10-22 | Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. The RTSP server on port 7070… |
CVE-2018-18541 | High | 7.5 | 2018-10-20 | In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could sen… |
CVE-2018-5156 | Critical | 9.8 | 2018-10-18 | A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being… |
CVE-2018-12387 | Critical | 9.1 | 2018-10-18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes a… |
CVE-2018-12385 | High | 7.0 | 2018-10-18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This is… |
CVE-2018-12382 | Medium | 5.3 | 2018-10-18 | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain n… |
CVE-2018-12367 | Medium | 4.3 | 2018-10-18 | In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals… |
CVE-2018-0443 | High | 7.5 | 2018-10-17 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could all… |
CVE-2018-0378 | High | 8.6 | 2018-10-17 | A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an un… |
CVE-2018-0456 | High | 7.7 | 2018-10-17 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker t… |
CVE-2018-0416 | Medium | 5.3 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system infor… |
CVE-2018-0395 | High | 8.8 | 2018-10-17 | A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adj… |
CVE-2018-12153 | Medium | 6.5 | 2018-10-10 | Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058… |
CVE-2018-0062 | Medium | 5.3 | 2018-10-10 | A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenti… |
CVE-2018-0060 | Medium | 5.3 | 2018-10-10 | An improper input validation weakness in the device control daemon process (dcd) of Juniper Networks Junos OS allows an attacker to cause a Denial of Service t… |
CVE-2018-0058 | Medium | 5.9 | 2018-10-10 | Receipt of a specially crafted IPv6 exception packet may be able to trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the… |
CVE-2018-0056 | Medium | 6.5 | 2018-10-10 | If a duplicate MAC address is learned by two different interfaces on an MX Series device, the MAC address learning function correctly flaps between the interfa… |
CVE-2018-0055 | Medium | 6.5 | 2018-10-10 | Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment may result in a j… |
CVE-2018-0051 | High | 7.5 | 2018-10-10 | A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC… |
CVE-2018-0050 | High | 7.5 | 2018-10-10 | An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of t… |
CVE-2018-0045 | High | 8.8 | 2018-10-10 | Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execu… |
CVE-2018-0043 | High | 8.8 | 2018-10-10 | Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuousl… |
CVE-2018-8512 | Medium | 5.4 | 2018-10-10 | A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially craft… |
CVE-2018-8490 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8489 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8265 | High | 7.8 | 2018-10-10 | A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Cod… |
CVE-2018-12479 | Medium | 6.5 | 2018-10-09 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are o… |
CVE-2018-12478 | Medium | 4.8 | 2018-10-09 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected relea… |
CVE-2018-12474 | Medium | 5.4 | 2018-10-09 | Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current buil… |
CVE-2018-14656 | High | 7.0 | 2018-10-08 | A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address in… |
CVE-2016-7475 | High | 7.5 | 2018-10-08 | Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not properly clean-up pool… |
CVE-2018-1000809 | High | 7.5 | 2018-10-08 | privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This at… |
CVE-2018-18021 | High | 7.1 | 2018-10-07 | arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers wh… |
CVE-2018-13042 | Medium | 5.9 | 2018-10-05 | The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo… |
CVE-2018-15431 | High | 7.3 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15430 | High | 7.2 | 2018-10-05 | A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentic… |
CVE-2018-15429 | Medium | 5.3 | 2018-10-05 | A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive informatio… |
CVE-2018-15428 | Medium | 6.8 | 2018-10-05 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker t… |
CVE-2018-15425 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15424 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15422 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15421 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15420 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15419 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15418 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15417 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15416 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15415 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15414 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15413 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15412 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15411 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15410 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15409 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15408 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15387 | Critical | 9.8 | 2018-10-05 | A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulner… |
CVE-2018-15369 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an aff… |
CVE-2018-15368 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0485 | High | 8.6 | 2018-10-05 | A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4… |
CVE-2018-0475 | High | 7.4 | 2018-10-05 | A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-0472 | High | 8.6 | 2018-10-05 | A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could al… |
CVE-2018-0467 | High | 8.6 | 2018-10-05 | A vulnerability in the IPv6 processing code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The… |
CVE-2018-0462 | Medium | 4.9 | 2018-10-05 | A vulnerability in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to p… |
CVE-2018-0447 | Medium | 5.3 | 2018-10-05 | A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, r… |
CVE-2018-0440 | High | 7.2 | 2018-10-05 | A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the und… |
CVE-2018-0438 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0197 | Medium | 6.5 | 2018-10-05 | A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-5492 | Critical | 9.8 | 2018-10-04 | NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution. |
CVE-2018-14826 | Critical | 9.8 | 2018-10-02 | Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted… |
CVE-2018-9452 | Medium | 5.5 | 2018-10-02 | In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if… |
CVE-2018-11750 | Medium | 6.5 | 2018-10-02 | Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, hos… |
CVE-2018-15701 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2018-15700 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2015-9268 | High | 7.8 | 2018-10-01 | Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in whic… |
CVE-2018-16587 | Medium | 6.5 | 2018-09-28 | In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS sys… |
CVE-2018-8850 | Critical | 9.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a… |
CVE-2018-6119 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6055 | High | 8.8 | 2018-09-25 | Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside… |
CVE-2018-6050 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6048 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a craft… |
CVE-2018-6047 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted… |
CVE-2018-6046 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6043 | High | 8.8 | 2018-09-25 | Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary pr… |
CVE-2018-6042 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6041 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |