CWE-20 · Improper Input Validation (page 72)
Page 72 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9494 | Medium | 6.5 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's adv… |
CVE-2016-6567 | Critical | 9.8 | 2018-07-13 | SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some… |
CVE-2016-6565 | High | 7.5 | 2018-07-13 | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request… |
CVE-2016-6542 | Low | 3.7 | 2018-07-13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the d… |
CVE-2018-13796 | Medium | 6.5 | 2018-07-12 | An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. |
CVE-2018-14009 | Critical | 9.8 | 2018-07-12 | Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. |
CVE-2017-18155 | High | 7.8 | 2018-07-12 | While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, an uninit… |
CVE-2018-0037 | Critical | 9.8 | 2018-07-11 | Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages… |
CVE-2018-0034 | Medium | 5.3 | 2018-07-11 | A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted… |
CVE-2018-0032 | High | 7.5 | 2018-07-11 | The receipt of a crafted BGP UPDATE can lead to a routing process daemon (RPD) crash and restart. Repeated receipt of the same crafted BGP UPDATE can result in… |
CVE-2018-0027 | High | 7.5 | 2018-07-11 | Receipt of a crafted or malformed RSVP PATH message may cause the routing protocol daemon (RPD) to hang or crash. When RPD is unavailable, routing updates cann… |
CVE-2018-8007 | High | 7.2 | 2018-07-11 | Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration setti… |
CVE-2018-8311 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remot… |
CVE-2018-8300 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka "Microso… |
CVE-2018-8260 | High | 8.8 | 2018-07-11 | A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framework Remote Code Exe… |
CVE-2018-8232 | High | 7.8 | 2018-07-11 | A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering Vulnerability." This affect… |
CVE-2018-2439 | Medium | 5.9 | 2018-07-10 | The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for a… |
CVE-2018-10891 | High | 7.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is… |
CVE-2018-10943 | High | 7.5 | 2018-07-10 | An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3. Sending an arbitrary unexpected string to TCP port 7100… |
CVE-2018-10888 | Medium | 6.5 | 2018-07-10 | A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading… |
CVE-2018-13389 | Medium | 4.7 | 2018-07-10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attach… |
CVE-2018-13795 | High | 7.5 | 2018-07-09 | Gravity before 0.5.1 does not support a maximum recursion depth. |
CVE-2018-1000617 | High | 7.5 | 2018-07-09 | Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can… |
CVE-2017-3197 | Critical | 9.8 | 2018-07-09 | GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PR… |
CVE-2018-3597 | High | 7.8 | 2018-07-06 | In the ADSP RPC driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-… |
CVE-2018-13348 | High | 7.5 | 2018-07-06 | The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the curr… |
CVE-2018-13346 | High | 7.5 | 2018-07-06 | The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, ak… |
CVE-2017-16816 | Medium | 6.5 | 2018-07-05 | The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by le… |
CVE-2018-8038 | High | 7.5 | 2018-07-05 | Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the ap… |
CVE-2018-10885 | Medium | 6.5 | 2018-07-05 | In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An… |
CVE-2018-9242 | Medium | 5.5 | 2018-07-03 | The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete file… |
CVE-2018-3753 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can co… |
CVE-2018-3752 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can co… |
CVE-2018-3751 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can… |
CVE-2018-3750 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can cont… |
CVE-2018-3749 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part… |
CVE-2018-11316 | Critical | 9.6 | 2018-07-03 | The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and priv… |
CVE-2018-11314 | Critical | 9.6 | 2018-07-03 | The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privilege… |
CVE-2018-7635 | Medium | 5.3 | 2018-07-03 | Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows… |
CVE-2018-7787 | Medium | 5.3 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTT… |
CVE-2018-7784 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a comm… |
CVE-2018-7777 | High | 8.8 | 2018-07-03 | The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software version… |
CVE-2018-4851 | High | 8.2 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause… |
CVE-2018-10843 | High | 8.5 | 2018-07-02 | source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalat… |
CVE-2018-13056 | High | 7.5 | 2018-07-02 | An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table… |
CVE-2018-10874 | High | 7.8 | 2018-07-02 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allo… |
CVE-2017-17175 | Medium | 6.5 | 2018-07-02 | Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerabil… |
CVE-2018-12999 | High | 7.5 | 2018-06-29 | Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server witho… |
CVE-2018-12988 | High | 7.5 | 2018-06-29 | GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI. |
CVE-2018-5528 | Medium | 5.3 | 2018-06-27 | Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. |
CVE-2018-3840 | High | 7.5 | 2018-06-26 | A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing of a network packet… |
CVE-2018-1374 | Medium | 5.3 | 2018-06-26 | An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) client connecting to a Q… |
CVE-2018-12712 | High | 8.8 | 2018-06-26 | An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP… |
CVE-2018-1000607 | Medium | 6.5 | 2018-06-26 | A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rul… |
CVE-2018-1000533 | Critical | 9.8 | 2018-06-26 | klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result i… |
CVE-2018-1000531 | High | 7.5 | 2018-06-26 | inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an… |
CVE-2018-1000523 | High | 8.1 | 2018-06-26 | topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a… |
CVE-2018-1000205 | Medium | 5.5 | 2018-06-26 | U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack ap… |
CVE-2018-0529 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2018-11046 | Medium | 6.5 | 2018-06-25 | Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker wi… |
CVE-2017-9312 | High | 7.5 | 2018-06-25 | Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a c… |
CVE-2018-12703 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers to steal assets (e.g… |
CVE-2018-12702 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackers to steal assets… |
CVE-2018-12694 | High | 7.5 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json. |
CVE-2018-12688 | Critical | 9.8 | 2018-06-22 | tinyexr 0.9.5 has a segmentation fault in the wav2Decode function. |
CVE-2017-7466 | High | 8.0 | 2018-06-22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client syste… |
CVE-2018-12635 | High | 7.5 | 2018-06-22 | CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. |
CVE-2018-7679 | Critical | 9.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not valida… |
CVE-2017-2669 | Low | 3.7 | 2018-06-21 | Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the I… |
CVE-2018-0373 | Medium | 5.5 | 2018-06-21 | A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could all… |
CVE-2018-0371 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2018-0337 | High | 7.8 | 2018-06-21 | A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2018-0331 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol (formerly known as CDP) subsystem of devices running, or based on, Cisco NX-OS Software contain a vulnerability… |
CVE-2018-0313 | High | 8.8 | 2018-06-21 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interf… |
CVE-2018-0306 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected dev… |
CVE-2018-0303 | High | 8.8 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2018-0302 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buf… |
CVE-2018-0299 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, rem… |
CVE-2018-0298 | High | 7.5 | 2018-06-21 | A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overfl… |
CVE-2018-0314 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services (CFS) component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to… |
CVE-2018-0312 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0308 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0307 | High | 7.8 | 2018-06-20 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. Th… |
CVE-2018-0304 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to read… |
CVE-2018-0301 | Critical | 9.8 | 2018-06-20 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on… |
CVE-2018-0295 | High | 7.5 | 2018-06-20 | A vulnerability in the Border Gateway Protocol (BGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial o… |
CVE-2018-0291 | Medium | 6.5 | 2018-06-20 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker t… |
CVE-2018-8030 | High | 7.5 | 2018-06-20 | A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with… |
CVE-2018-11537 | Medium | 6.5 | 2018-06-19 | Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorPro… |
CVE-2018-1061 | Medium | 6.5 | 2018-06-19 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker… |
CVE-2018-12565 | High | 8.8 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execu… |
CVE-2018-12564 | Medium | 6.5 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force la… |
CVE-2018-12563 | Medium | 6.5 | 2018-06-19 | An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from… |
CVE-2018-12562 | Critical | 9.8 | 2018-06-19 | An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the ar… |
CVE-2018-12561 | High | 8.8 | 2018-06-19 | An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by… |
CVE-2018-9025 | High | 7.5 | 2018-06-18 | An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input. |
CVE-2018-9023 | High | 8.8 | 2018-06-18 | An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted argu… |
CVE-2015-4664 | Critical | 9.8 | 2018-06-18 | An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands. |
CVE-2018-1060 | High | 7.5 | 2018-06-18 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use… |
CVE-2018-5753 | Medium | 6.5 | 2018-06-16 | The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows… |