CWE-20 · Improper Input Validation (page 71)
Page 71 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0604 | Critical | 9.8 | 2019-03-05 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2019-0594 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2019-6219 | High | 7.5 | 2019-03-05 | A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, watchOS 5.1.3. Processing a maliciou… |
CVE-2018-19640 | Medium | 4.4 | 2019-03-05 | If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can k… |
CVE-2018-19636 | High | 7.3 | 2019-03-05 | Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an… |
CVE-2019-6555 | High | 7.8 | 2019-02-28 | Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker t… |
CVE-2018-12401 | High | 7.5 | 2019-02-28 | Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denia… |
CVE-2019-1988 | High | 8.8 | 2019-02-28 | In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in system_serv… |
CVE-2018-13904 | Critical | 9.8 | 2019-02-25 | Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer El… |
CVE-2018-11935 | Medium | 5.3 | 2019-02-25 | Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2018-11932 | Critical | 9.1 | 2019-02-25 | Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2018-11931 | High | 7.8 | 2019-02-25 | Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Elect… |
CVE-2018-11864 | Medium | 5.5 | 2019-02-25 | Bytes can be written to fuses from Secure region which can be read later by HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co… |
CVE-2019-1689 | High | 7.3 | 2019-02-25 | A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope… |
CVE-2019-1691 | Medium | 5.8 | 2019-02-21 | A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected rest… |
CVE-2018-1945 | Medium | 6.1 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the vict… |
CVE-2019-8954 | High | 8.8 | 2019-02-20 | In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the… |
CVE-2019-5783 | High | 8.8 | 2019-02-19 | Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection att… |
CVE-2019-5780 | High | 7.8 | 2019-02-19 | Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript… |
CVE-2019-5769 | High | 8.8 | 2019-02-19 | Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentia… |
CVE-2018-20782 | High | 7.5 | 2019-02-17 | The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages. |
CVE-2019-0255 | High | 8.1 | 2019-02-15 | SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system… |
CVE-2018-6267 | High | 7.8 | 2019-02-13 | NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software does not validate or incorrectly validates input that can affect the cont… |
CVE-2018-19008 | High | 7.8 | 2019-02-13 | The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wherein the applicati… |
CVE-2017-0938 | High | 7.5 | 2019-02-12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. |
CVE-2018-5499 | High | 7.5 | 2019-02-12 | ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS). |
CVE-2018-12549 | Critical | 9.8 | 2019-02-11 | In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it. |
CVE-2018-12547 | Critical | 9.8 | 2019-02-11 | In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs… |
CVE-2018-11847 | High | 7.8 | 2019-02-11 | Malicious TA can tag QSEE kernel memory and map to EL0, there by corrupting the physical memory as well it can be used to corrupt the QSEE kernel and compromis… |
CVE-2018-20771 | Critical | 9.8 | 2019-02-10 | An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic… |
CVE-2018-20767 | High | 8.8 | 2019-02-10 | An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic… |
CVE-2019-1676 | Medium | 6.8 | 2019-02-08 | A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated, remote attacker… |
CVE-2019-1680 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability… |
CVE-2019-1678 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application… |
CVE-2019-7412 | Critical | 9.8 | 2019-02-05 | The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. |
CVE-2018-15778 | High | 8.8 | 2019-02-04 | Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-line interface (CLI). |
CVE-2018-18988 | High | 8.8 | 2019-02-01 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code exe… |
CVE-2018-5498 | Medium | 4.4 | 2019-02-01 | Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Denial of Service (DoS)… |
CVE-2018-6241 | High | 7.8 | 2019-01-31 | NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the registerbuffer API, which may lead to arbit… |
CVE-2018-15136 | Medium | 5.3 | 2019-01-30 | TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entir… |
CVE-2018-19010 | Medium | 6.5 | 2019-01-28 | Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2018-20743 | High | 7.5 | 2019-01-25 | murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to… |
CVE-2017-18359 | High | 7.5 | 2019-01-25 | PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by… |
CVE-2019-1656 | Medium | 5.3 | 2019-01-24 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to access the shell of the unde… |
CVE-2019-1652 | High | 7.2 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote… |
CVE-2019-1650 | High | 8.8 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2019-1648 | High | 7.8 | 2019-01-24 | A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an aff… |
CVE-2017-15720 | High | 8.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. |
CVE-2019-6339 | Critical | 9.8 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar s… |
CVE-2016-10739 | Medium | 5.3 | 2019-01-21 | In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by w… |
CVE-2018-5869 | High | 7.8 | 2019-01-18 | Improper input validation in the QTEE keymaster app can lead to invalid memory access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MS… |
CVE-2018-11999 | Medium | 5.5 | 2019-01-18 | Improper input validation in trustzone can lead to denial of service in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM96… |
CVE-2017-3142 | Medium | 5.3 | 2019-01-16 | An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TS… |
CVE-2018-20720 | High | 7.5 | 2019-01-16 | ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reb… |
CVE-2017-6921 | Medium | 5.9 | 2019-01-15 | In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site… |
CVE-2018-4277 | High | 7.5 | 2019-01-11 | In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handlin… |
CVE-2018-4254 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, an input validation issue existed in the kernel. This issue was addressed with improved input validation. |
CVE-2018-4213 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4209 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4208 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4207 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2017-13891 | Medium | 6.5 | 2019-01-11 | In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management. |
CVE-2018-15460 | High | 8.6 | 2019-01-10 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remo… |
CVE-2018-20684 | High | 7.5 | 2019-01-10 | In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelate… |
CVE-2017-1002157 | Critical | 9.8 | 2019-01-10 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. |
CVE-2018-12167 | Medium | 4.4 | 2019-01-10 | Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial… |
CVE-2018-12166 | Medium | 4.4 | 2019-01-10 | Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a den… |
CVE-2018-15453 | High | 8.6 | 2019-01-10 | A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco Asyn… |
CVE-2018-4047 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4046 | Medium | 5.5 | 2019-01-10 | An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with loca… |
CVE-2018-4045 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4044 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4043 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with loca… |
CVE-2018-4042 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4041 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4037 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access can use th… |
CVE-2018-4036 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4035 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4034 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4033 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4032 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could… |
CVE-2018-20683 | High | 8.1 | 2019-01-10 | commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by tr… |
CVE-2018-16196 | High | 7.5 | 2019-01-09 | Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50)… |
CVE-2018-16185 | High | 7.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-6169 | Medium | 6.5 | 2019-01-09 | Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwant… |
CVE-2018-6160 | Medium | 6.5 | 2019-01-09 | JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6140 | High | 8.8 | 2019-01-09 | Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to insta… |
CVE-2018-6139 | High | 8.8 | 2019-01-09 | Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a… |
CVE-2018-6114 | Medium | 6.5 | 2019-01-09 | Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via… |
CVE-2018-6113 | Medium | 6.5 | 2019-01-09 | Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofi… |
CVE-2018-6111 | High | 8.8 | 2019-01-09 | An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-6110 | Medium | 5.4 | 2019-01-09 | Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTM… |
CVE-2018-6096 | Medium | 6.5 | 2019-01-09 | A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscur… |
CVE-2018-6084 | High | 7.8 | 2019-01-09 | Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-20070 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omni… |
CVE-2018-20068 | Medium | 4.3 | 2019-01-09 | Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of t… |
CVE-2018-20065 | High | 8.8 | 2019-01-09 | Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user ges… |
CVE-2018-16088 | Medium | 6.5 | 2019-01-09 | A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no use… |
CVE-2018-16080 | Medium | 6.5 | 2019-01-09 | A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the… |