CWE-20 · Improper Input Validation (page 73)
Page 73 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6068 | Medium | 4.3 | 2018-11-14 | Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2018-17472 | Critical | 9.6 | 2018-11-14 | Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sand… |
CVE-2018-19204 | High | 8.8 | 2018-11-12 | PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with sys… |
CVE-2018-14644 | Medium | 5.3 | 2018-11-09 | An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a… |
CVE-2016-9749 | Medium | 4.0 | 2018-11-09 | IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation… |
CVE-2018-15450 | Medium | 6.5 | 2018-11-08 | A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system… |
CVE-2018-15449 | Medium | 4.3 | 2018-11-08 | A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attacker to cause a denia… |
CVE-2018-19114 | High | 8.8 | 2018-11-08 | An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin sessi… |
CVE-2018-6433 | Medium | 5.5 | 2018-11-08 | A vulnerability in the secryptocfg export command of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to bypass the… |
CVE-2018-16472 | High | 7.5 | 2018-11-06 | A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by a… |
CVE-2018-9362 | High | 7.5 | 2018-11-06 | In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation. This could lead to remote denia… |
CVE-2014-10077 | High | 7.5 | 2018-11-06 | Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a ca… |
CVE-2018-15454 | High | 8.6 | 2018-11-01 | A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defen… |
CVE-2018-14661 | Medium | 6.5 | 2018-10-31 | It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to… |
CVE-2016-2125 | Medium | 6.5 | 2018-10-31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba… |
CVE-2018-15324 | Medium | 5.9 | 2018-10-31 | On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access. |
CVE-2018-15323 | Medium | 5.9 | 2018-10-31 | On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the T… |
CVE-2018-15319 | High | 7.5 | 2018-10-31 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. T… |
CVE-2018-15318 | High | 7.5 | 2018-10-31 | In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary f… |
CVE-2018-16469 | High | 7.5 | 2018-10-30 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be p… |
CVE-2018-10711 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2015-5159 | High | 7.5 | 2018-10-30 | python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request. |
CVE-2018-11873 | High | 7.8 | 2018-10-29 | Improper input validation leads to buffer overwrite in the WLAN function that handles WLAN roam buffer in Snapdragon Mobile in version SD 845. |
CVE-2018-11872 | High | 7.8 | 2018-10-29 | Improper input validation leads to buffer overwrite in the WLAN function that handles WMI commands in Snapdragon Mobile in version SD 845, SD 850, SDA660 |
CVE-2018-11950 | High | 7.8 | 2018-10-26 | Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850 |
CVE-2018-7432 | High | 7.5 | 2018-10-23 | Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to… |
CVE-2018-7429 | High | 7.5 | 2018-10-23 | Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote attackers to cause a d… |
CVE-2018-14820 | High | 7.5 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbit… |
CVE-2017-18349 | Critical | 9.8 | 2018-10-23 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a cr… |
CVE-2017-18292 | Medium | 5.5 | 2018-10-23 | Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in… |
CVE-2018-13115 | Medium | 6.5 | 2018-10-22 | Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. The RTSP server on port 7070… |
CVE-2018-18541 | High | 7.5 | 2018-10-20 | In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could sen… |
CVE-2018-5156 | Critical | 9.8 | 2018-10-18 | A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being… |
CVE-2018-12387 | Critical | 9.1 | 2018-10-18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes a… |
CVE-2018-12385 | High | 7.0 | 2018-10-18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This is… |
CVE-2018-12382 | Medium | 5.3 | 2018-10-18 | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain n… |
CVE-2018-12367 | Medium | 4.3 | 2018-10-18 | In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals… |
CVE-2018-0443 | High | 7.5 | 2018-10-17 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could all… |
CVE-2018-0378 | High | 8.6 | 2018-10-17 | A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an un… |
CVE-2018-0456 | High | 7.7 | 2018-10-17 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker t… |
CVE-2018-0416 | Medium | 5.3 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system infor… |
CVE-2018-0395 | High | 8.8 | 2018-10-17 | A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adj… |
CVE-2018-12153 | Medium | 6.5 | 2018-10-10 | Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058… |
CVE-2018-0062 | Medium | 5.3 | 2018-10-10 | A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenti… |
CVE-2018-0060 | Medium | 5.3 | 2018-10-10 | An improper input validation weakness in the device control daemon process (dcd) of Juniper Networks Junos OS allows an attacker to cause a Denial of Service t… |
CVE-2018-0058 | Medium | 5.9 | 2018-10-10 | Receipt of a specially crafted IPv6 exception packet may be able to trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the… |
CVE-2018-0056 | Medium | 6.5 | 2018-10-10 | If a duplicate MAC address is learned by two different interfaces on an MX Series device, the MAC address learning function correctly flaps between the interfa… |
CVE-2018-0055 | Medium | 6.5 | 2018-10-10 | Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment may result in a j… |
CVE-2018-0051 | High | 7.5 | 2018-10-10 | A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC… |
CVE-2018-0050 | High | 7.5 | 2018-10-10 | An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of t… |
CVE-2018-0045 | High | 8.8 | 2018-10-10 | Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execu… |
CVE-2018-0043 | High | 8.8 | 2018-10-10 | Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuousl… |
CVE-2018-8512 | Medium | 5.4 | 2018-10-10 | A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially craft… |
CVE-2018-8490 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8489 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8265 | High | 7.8 | 2018-10-10 | A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Cod… |
CVE-2018-12479 | Medium | 6.5 | 2018-10-09 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are o… |
CVE-2018-12478 | Medium | 4.8 | 2018-10-09 | A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected relea… |
CVE-2018-12474 | Medium | 5.4 | 2018-10-09 | Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current buil… |
CVE-2018-14656 | High | 7.0 | 2018-10-08 | A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address in… |
CVE-2016-7475 | High | 7.5 | 2018-10-08 | Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not properly clean-up pool… |
CVE-2018-1000809 | High | 7.5 | 2018-10-08 | privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This at… |
CVE-2018-18021 | High | 7.1 | 2018-10-07 | arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers wh… |
CVE-2018-13042 | Medium | 5.9 | 2018-10-05 | The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo… |
CVE-2018-15431 | High | 7.3 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15430 | High | 7.2 | 2018-10-05 | A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentic… |
CVE-2018-15429 | Medium | 5.3 | 2018-10-05 | A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive informatio… |
CVE-2018-15428 | Medium | 6.8 | 2018-10-05 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker t… |
CVE-2018-15425 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15424 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15422 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15421 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15420 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15419 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15418 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15417 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15416 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15415 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15414 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15413 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15412 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15411 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15410 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15409 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15408 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15387 | Critical | 9.8 | 2018-10-05 | A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulner… |
CVE-2018-15369 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an aff… |
CVE-2018-15368 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0485 | High | 8.6 | 2018-10-05 | A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4… |
CVE-2018-0475 | High | 7.4 | 2018-10-05 | A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-0472 | High | 8.6 | 2018-10-05 | A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could al… |
CVE-2018-0467 | High | 8.6 | 2018-10-05 | A vulnerability in the IPv6 processing code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The… |
CVE-2018-0462 | Medium | 4.9 | 2018-10-05 | A vulnerability in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to p… |
CVE-2018-0447 | Medium | 5.3 | 2018-10-05 | A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, r… |
CVE-2018-0440 | High | 7.2 | 2018-10-05 | A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the und… |
CVE-2018-0438 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0197 | Medium | 6.5 | 2018-10-05 | A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-5492 | Critical | 9.8 | 2018-10-04 | NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution. |
CVE-2018-14826 | Critical | 9.8 | 2018-10-02 | Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted… |
CVE-2018-9452 | Medium | 5.5 | 2018-10-02 | In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if… |