CWE-20 · Improper Input Validation (page 74)
Page 74 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2018-3852 | High | 7.5 | 2018-06-06 | An exploitable denial of service vulnerability exists in the Ocularis Recorder functionality of Ocularis 5.5.0.242. A specially crafted TCP packet can cause a… |
CVE-2018-1268 | Medium | 6.8 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not va… |
CVE-2018-11808 | Critical | 9.1 | 2018-06-06 | Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any fi… |
CVE-2017-7653 | Medium | 5.3 | 2018-06-05 | The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject… |
CVE-2018-11678 | Critical | 9.8 | 2018-06-05 | plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie. |
CVE-2016-9042 | Medium | 5.9 | 2018-06-04 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network… |
CVE-2017-16026 | Medium | 5.9 | 2018-06-04 | Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is pas… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |
CVE-2017-16005 | High | 7.5 | 2018-06-04 | Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not th… |
CVE-2018-1002100 | Medium | 4.2 | 2018-06-02 | In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container… |
CVE-2018-5522 | Medium | 5.9 | 2018-06-01 | On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pai… |
CVE-2018-5513 | High | 7.5 | 2018-06-01 | On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a di… |
CVE-2017-17171 | Medium | 4.2 | 2018-06-01 | Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters. An attacker may trick a target… |
CVE-2016-10555 | Medium | 6.5 | 2018-05-31 | Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If th… |
CVE-2016-10544 | Medium | 5.9 | 2018-05-31 | uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used c… |
CVE-2016-10543 | Medium | 5.3 | 2018-05-31 | call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, w… |
CVE-2016-10542 | High | 7.5 | 2018-05-31 | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly… |
CVE-2016-10540 | High | 7.5 | 2018-05-31 | Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, patt… |
CVE-2016-10539 | High | 7.5 | 2018-05-31 | negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", wh… |
CVE-2016-10521 | High | 7.5 | 2018-05-31 | jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator. |
CVE-2016-10520 | High | 7.5 | 2018-05-31 | jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2015-9239 | High | 7.5 | 2018-05-31 | ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2018-11481 | High | 8.8 | 2018-05-30 | TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr… |
CVE-2018-11518 | High | 8.1 | 2018-05-30 | A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based… |
CVE-2018-10995 | Medium | 5.3 | 2018-05-30 | SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields). |
CVE-2018-11548 | High | 7.5 | 2018-05-29 | An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address. |
CVE-2015-9242 | High | 7.5 | 2018-05-29 | Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash… |
CVE-2015-9241 | High | 7.5 | 2018-05-29 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 e… |
CVE-2015-9235 | Critical | 9.8 | 2018-05-29 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES fami… |
CVE-2018-11479 | High | 7.8 | 2018-05-25 | The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pi… |
CVE-2018-1137 | High | 8.1 | 2018-05-25 | An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged… |
CVE-2018-5487 | Critical | 9.8 | 2018-05-24 | NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to… |
CVE-2017-17315 | Medium | 5.3 | 2018-05-24 | Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V10… |
CVE-2017-17158 | Medium | 4.6 | 2018-05-24 | Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the v… |
CVE-2018-1000040 | Medium | 5.5 | 2018-05-24 | In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or… |
CVE-2018-1000037 | Medium | 5.5 | 2018-05-24 | In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafte… |
CVE-2018-11411 | High | 7.5 | 2018-05-24 | The transferFrom function of a smart contract implementation for DimonCoin (FUD), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all… |
CVE-2018-8176 | High | 8.8 | 2018-05-23 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoi… |
CVE-2018-11357 | High | 7.5 | 2018-05-22 | In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbu… |
CVE-2018-11354 | High | 7.5 | 2018-05-22 | In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string ha… |
CVE-2017-2617 | High | 7.6 | 2018-05-22 | hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which cou… |
CVE-2018-11321 | Medium | 6.5 | 2018-05-22 | An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filt… |
CVE-2018-11367 | High | 7.5 | 2018-05-22 | An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module. |
CVE-2018-11315 | Medium | 6.5 | 2018-05-20 | The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remot… |
CVE-2018-4992 | High | 7.8 | 2018-05-19 | Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper input validation vulnerability. Successful exploitation co… |
CVE-2018-4943 | High | 8.8 | 2018-05-19 | Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to Jav… |
CVE-2018-8867 | High | 7.5 | 2018-05-18 | In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 al… |
CVE-2018-11232 | Medium | 5.5 | 2018-05-18 | The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service… |
CVE-2018-9970 | High | 8.8 | 2018-05-17 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to ex… |
CVE-2018-9935 | High | 8.8 | 2018-05-17 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2018-7159 | Medium | 5.3 | 2018-05-17 | The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interprete… |
CVE-2018-0325 | High | 7.5 | 2018-05-17 | A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones… |
CVE-2018-0280 | High | 7.5 | 2018-05-17 | A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to c… |
CVE-2018-0279 | High | 8.8 | 2018-05-17 | A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker… |
CVE-2018-4850 | High | 7.5 | 2018-05-16 | A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMATIC S7-400 (incl. F) CPU hardware versio… |
CVE-2018-3634 | Medium | 5.5 | 2018-05-15 | Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local access. |
CVE-2018-3611 | Medium | 6.5 | 2018-05-15 | Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial of service via local… |
CVE-2017-14439 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14438 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-12124 | Medium | 6.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-6021 | High | 7.5 | 2018-05-14 | In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build… |
CVE-2018-11035 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-11034 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-3612 | High | 7.8 | 2018-05-10 | Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM). |
CVE-2018-10977 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10976 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10975 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10974 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10955 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10954 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10953 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10952 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-2416 | Medium | 5.4 | 2018-05-09 | SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source. |
CVE-2018-0961 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data, aka "Hyper-V vSMB Remote Code E… |
CVE-2018-0959 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-10828 | Medium | 5.5 | 2018-05-09 | An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object… |
CVE-2018-10830 | High | 7.8 | 2018-05-09 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-1000168 | High | 7.5 | 2018-05-08 | nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segment… |
CVE-2018-10809 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-10799 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.loc… |
CVE-2018-10798 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the re… |
CVE-2018-10796 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-10776 | High | 7.8 | 2018-05-07 | The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application… |
CVE-2018-0494 | Medium | 6.5 | 2018-05-06 | GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. |
CVE-2018-9154 | High | 7.5 | 2018-05-04 | There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack… |
CVE-2017-15043 | High | 8.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2011-0704 | Medium | 5.9 | 2018-05-04 | 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request. |
CVE-2018-8869 | Critical | 9.8 | 2018-05-04 | In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. A CVSS v3 base score of 9.8 has been calculated; the CVSS v… |
CVE-2018-0287 | High | 8.8 | 2018-05-02 | A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execut… |
CVE-2018-0264 | Critical | 9.6 | 2018-05-02 | A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execut… |
CVE-2018-0253 | Critical | 9.8 | 2018-05-02 | A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary co… |
CVE-2018-0249 | Medium | 4.3 | 2018-05-02 | A vulnerability when handling incoming 802.11 Association Requests for Cisco Aironet 1800 Series Access Point (APs) on Qualcomm Atheros (QCA) based hardware pl… |
CVE-2018-0235 | High | 7.4 | 2018-05-02 | A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to ca… |
CVE-2018-0234 | High | 8.6 | 2018-05-02 | A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) functionality in Cisco Aironet 1810, 1830, and 1850 Series Access Points coul… |
CVE-2018-10578 | Critical | 9.8 | 2018-05-02 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect… |
CVE-2018-8115 | High | 8.6 | 2018-05-02 | A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a co… |
CVE-2018-1104 | High | 8.8 | 2018-05-02 | Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on… |
CVE-2018-10657 | High | 7.5 | 2018-05-02 | Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to feder… |