CWE-20 · Improper Input Validation (page 71)
Page 71 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000647 | High | 7.1 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of servic… |
CVE-2018-15358 | High | 8.8 | 2018-08-17 | An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-10873 | High | 8.3 | 2018-08-17 | A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malic… |
CVE-2018-15122 | High | 7.8 | 2018-08-16 | An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a… |
CVE-2018-10140 | Medium | 4.3 | 2018-08-16 | The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, result… |
CVE-2018-0419 | High | 7.5 | 2018-08-15 | A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass t… |
CVE-2018-0418 | High | 8.6 | 2018-08-15 | A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthen… |
CVE-2018-0409 | High | 7.5 | 2018-08-15 | A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Commun… |
CVE-2018-8414 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerabili… |
CVE-2018-8412 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka… |
CVE-2018-8339 | High | 7.0 | 2018-08-15 | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr… |
CVE-2018-8316 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, aka "Internet Explorer… |
CVE-2018-12537 | Medium | 5.3 | 2018-08-14 | In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters f… |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-15185 | Medium | 6.5 | 2018-08-10 | PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and Java… |
CVE-2018-10908 | Medium | 6.5 | 2018-08-09 | It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attac… |
CVE-2017-16790 | Medium | 6.5 | 2018-08-06 | An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler c… |
CVE-2018-7059 | High | 8.8 | 2018-08-06 | Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could u… |
CVE-2018-13877 | High | 7.5 | 2018-08-06 | The doPayouts() function of the smart contract implementation for MegaCryptoPolis, an Ethereum game, has a Denial of Service vulnerability. If a smart contract… |
CVE-2018-9866 | Critical | 9.8 | 2018-08-03 | A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow… |
CVE-2018-3777 | Critical | 9.8 | 2018-08-03 | Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests. |
CVE-2018-14923 | High | 7.8 | 2018-08-03 | A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback. |
CVE-2018-14774 | High | 7.2 | 2018-08-03 | An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13… |
CVE-2018-14872 | High | 7.5 | 2018-08-03 | An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows a… |
CVE-2018-10922 | High | 7.5 | 2018-08-02 | An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due to ttembed trusting… |
CVE-2018-10921 | Medium | 4.3 | 2018-08-02 | Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially lead to corruption of the input file due… |
CVE-2018-12448 | Medium | 5.3 | 2018-08-02 | Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allo… |
CVE-2018-10920 | Medium | 6.8 | 2018-08-02 | Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache. |
CVE-2016-9579 | Medium | 6.5 | 2018-08-01 | A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unaut… |
CVE-2016-8651 | Low | 3.1 | 2018-08-01 | An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull a… |
CVE-2018-3650 | High | 7.8 | 2018-08-01 | Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sani… |
CVE-2018-10916 | Medium | 5.3 | 2018-08-01 | It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local sy… |
CVE-2018-1999037 | Medium | 4.3 | 2018-08-01 | A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop track… |
CVE-2018-14775 | Medium | 5.5 | 2018-08-01 | tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386… |
CVE-2016-8625 | Medium | 5.3 | 2018-08-01 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue n… |
CVE-2016-8624 | Medium | 5.3 | 2018-07-31 | curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be t… |
CVE-2018-14281 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to ex… |
CVE-2018-14280 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to ex… |
CVE-2016-8631 | Medium | 6.3 | 2018-07-31 | The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially ov… |
CVE-2016-8611 | Medium | 4.3 | 2018-07-31 | A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenti… |
CVE-2016-8626 | Medium | 6.5 | 2018-07-31 | A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial… |
CVE-2017-13652 | Medium | 6.5 | 2018-07-31 | NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended ac… |
CVE-2018-7934 | Medium | 5.5 | 2018-07-31 | Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability because they do not adapt to specific sc… |
CVE-2018-14581 | High | 7.8 | 2018-07-31 | Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL o… |
CVE-2018-12941 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system command at the end… |
CVE-2018-14767 | Critical | 9.8 | 2018-07-31 | In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. T… |
CVE-2018-3772 | Critical | 9.8 | 2018-07-30 | Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated… |
CVE-2018-9066 | High | 8.8 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a… |
CVE-2018-10903 | High | 7.5 | 2018-07-30 | A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not va… |
CVE-2018-14680 | Medium | 6.5 | 2018-07-28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. |
CVE-2016-9578 | High | 7.5 | 2018-07-27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted me… |
CVE-2016-9577 | High | 7.5 | 2018-07-27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE se… |
CVE-2017-2674 | Medium | 6.1 | 2018-07-27 | JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user i… |
CVE-2017-2658 | Low | 2.6 | 2018-07-27 | It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3… |
CVE-2017-2653 | Medium | 4.1 | 2018-07-27 | A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allo… |
CVE-2017-2614 | Medium | 6.8 | 2018-07-27 | When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. Thi… |
CVE-2017-12173 | Medium | 4.3 | 2018-07-27 | It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to in… |
CVE-2017-12148 | High | 8.4 | 2018-07-27 | A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'd… |
CVE-2017-12171 | Medium | 6.5 | 2018-07-26 | A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be par… |
CVE-2017-7509 | Low | 3.5 | 2018-07-26 | An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not prese… |
CVE-2017-7539 | Medium | 5.3 | 2018-07-26 | An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine w… |
CVE-2016-8647 | Medium | 4.9 | 2018-07-26 | An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstanc… |
CVE-2018-5542 | High | 8.1 | 2018-07-25 | F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server. |
CVE-2018-5537 | Medium | 5.3 | 2018-07-25 | A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is… |
CVE-2018-5531 | High | 7.4 | 2018-07-25 | Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a denial of… |
CVE-2018-11044 | Medium | 6.5 | 2018-07-24 | Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior… |
CVE-2017-3180 | Medium | 5.4 | 2018-07-24 | Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An at… |
CVE-2018-11452 | High | 7.5 | 2018-07-23 | A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethe… |
CVE-2018-11451 | High | 7.5 | 2018-07-23 | A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethe… |
CVE-2016-10728 | Medium | 5.3 | 2018-07-23 | An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses t… |
CVE-2018-1999018 | Medium | 6.6 | 2018-07-23 | Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScan… |
CVE-2018-1503 | Medium | 4.3 | 2018-07-23 | IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause messages to no longer… |
CVE-2018-14505 | High | 8.8 | 2018-07-22 | mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. |
CVE-2018-14438 | High | 7.5 | 2018-07-20 | In Wireshark through 2.6.2, the create_app_running_mutex function in wsutil/file_util.c calls SetSecurityDescriptorDacl to set a NULL DACL, which allows attack… |
CVE-2018-10870 | Critical | 9.8 | 2018-07-19 | redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potenti… |
CVE-2018-14336 | High | 7.5 | 2018-07-19 | TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses. |
CVE-2018-12959 | High | 7.5 | 2018-07-19 | The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all… |
CVE-2018-5535 | High | 7.5 | 2018-07-19 | On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server with an associated… |
CVE-2018-5534 | High | 7.5 | 2018-07-19 | Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward pr… |
CVE-2018-5533 | High | 7.5 | 2018-07-19 | Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic. |
CVE-2017-7481 | Critical | 9.8 | 2018-07-19 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls… |
CVE-2018-14369 | High | 7.5 | 2018-07-19 | In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the HTTP2 dissector could crash. This was addressed in epan/dissectors/packet-http2.c by veri… |
CVE-2018-14339 | High | 7.5 | 2018-07-19 | In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by addi… |
CVE-2018-0394 | High | 8.8 | 2018-07-18 | A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell acces… |
CVE-2018-0387 | High | 8.8 | 2018-07-18 | A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, po… |
CVE-2018-0349 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2018-0345 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary co… |
CVE-2018-10616 | High | 7.8 | 2018-07-18 | ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer wh… |
CVE-2017-18103 | Medium | 4.7 | 2018-07-18 | The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Bro… |
CVE-2018-14361 | Critical | 9.8 | 2018-07-17 | An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data. |
CVE-2018-14351 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. |
CVE-2018-14349 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. |
CVE-2017-15137 | Medium | 4.3 | 2018-07-16 | The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with… |
CVE-2018-0385 | High | 7.5 | 2018-07-16 | A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthentica… |
CVE-2018-0369 | High | 8.6 | 2018-07-16 | A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacke… |
CVE-2018-0361 | Low | 3.3 | 2018-07-16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. |
CVE-2018-14071 | Critical | 9.8 | 2018-07-16 | The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. |
CVE-2018-14089 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <=… |
CVE-2018-14085 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that th… |
CVE-2018-14055 | Medium | 6.5 | 2018-07-15 | ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue v… |