CWE-20 · Improper Input Validation (page 74)
Page 74 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11750 | Medium | 6.5 | 2018-10-02 | Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, hos… |
CVE-2018-15701 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2018-15700 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2015-9268 | High | 7.8 | 2018-10-01 | Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in whic… |
CVE-2018-16587 | Medium | 6.5 | 2018-09-28 | In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS sys… |
CVE-2018-8850 | Critical | 9.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a… |
CVE-2018-6119 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6055 | High | 8.8 | 2018-09-25 | Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside… |
CVE-2018-6050 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6048 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a craft… |
CVE-2018-6047 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted… |
CVE-2018-6046 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6043 | High | 8.8 | 2018-09-25 | Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary pr… |
CVE-2018-6042 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6041 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6039 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6036 | Medium | 6.5 | 2018-09-25 | Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page. |
CVE-2018-6033 | High | 8.8 | 2018-09-25 | Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox v… |
CVE-2018-6032 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-15960 | High | 7.5 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerabili… |
CVE-2018-14318 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is requir… |
CVE-2018-10502 | High | 7.8 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must… |
CVE-2018-10499 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker m… |
CVE-2018-10497 | High | 7.8 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must firs… |
CVE-2018-10496 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Internet Browser Fixed in version 6.4.0.15. User in… |
CVE-2018-14889 | High | 7.8 | 2018-09-21 | CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability. |
CVE-2018-14732 | High | 7.5 | 2018-09-21 | An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not… |
CVE-2018-13111 | Medium | 5.9 | 2018-09-21 | There exists a partial Denial of Service vulnerability in Wanscam HW0021 IP Cameras. An attacker could craft a malicious POST request to crash the ONVIF servic… |
CVE-2018-15832 | High | 8.8 | 2018-09-20 | upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vu… |
CVE-2018-11287 | Critical | 9.8 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 45… |
CVE-2018-3574 | Medium | 5.5 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace can request ION cache maintenance on a se… |
CVE-2018-11071 | High | 7.5 | 2018-09-18 | Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0… |
CVE-2018-11302 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received from userspace befo… |
CVE-2018-11294 | High | 8.0 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handler indication from the firmware gets the… |
CVE-2018-11280 | Medium | 5.5 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space there is no size valida… |
CVE-2018-14641 | Medium | 6.5 | 2018-09-18 | A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a… |
CVE-2018-16956 | Medium | 6.5 | 2018-09-18 | The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be… |
CVE-2018-14631 | High | 8.8 | 2018-09-17 | moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provid… |
CVE-2018-14630 | High | 8.8 | 2018-09-17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing leg… |
CVE-2017-15705 | Medium | 5.3 | 2018-09-17 | A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails… |
CVE-2018-1791 | Medium | 4.9 | 2018-09-14 | IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting s… |
CVE-2018-17019 | High | 7.5 | 2018-09-13 | In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc. |
CVE-2018-1330 | High | 7.5 | 2018-09-13 | When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP reques… |
CVE-2018-5549 | High | 7.5 | 2018-09-13 | On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elemen… |
CVE-2018-5545 | High | 8.8 | 2018-09-13 | On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload. |
CVE-2018-8474 | High | 7.5 | 2018-09-13 | A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Fe… |
CVE-2018-8439 | High | 8.4 | 2018-09-13 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8438 | Medium | 6.8 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8437 | Medium | 6.2 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8436 | Medium | 6.2 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8434 | Medium | 5.4 | 2018-09-13 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2018-8421 | Critical | 9.8 | 2018-09-13 | A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability."… |
CVE-2018-0965 | High | 8.4 | 2018-09-13 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-12176 | High | 8.2 | 2018-09-12 | Improper input validation in firmware for Intel NUC Kits may allow a privileged user to potentially execute arbitrary code resulting in information disclosure… |
CVE-2018-7923 | High | 7.8 | 2018-09-12 | Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter che… |
CVE-2018-7922 | High | 7.8 | 2018-09-12 | Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter che… |
CVE-2018-7906 | Medium | 5.5 | 2018-09-12 | Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability. An attacker ca… |
CVE-2018-6924 | High | 7.1 | 2018-09-12 | In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF header parser could all… |
CVE-2017-1082 | High | 7.5 | 2018-09-12 | In FreeBSD 11.x before 11.1-RELEASE and 10.x before 10.4-RELEASE, the qsort algorithm has a deterministic recursion pattern. Feeding a pathological input to th… |
CVE-2018-13807 | High | 8.6 | 2018-09-12 | A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web inte… |
CVE-2018-2465 | High | 7.5 | 2018-09-11 | SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hac… |
CVE-2018-2462 | High | 8.8 | 2018-09-11 | In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document acce… |
CVE-2018-10935 | Medium | 6.5 | 2018-09-11 | A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. |
CVE-2016-7074 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7073 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7069 | Medium | 5.9 | 2018-09-11 | An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to a… |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2018-14635 | Medium | 6.5 | 2018-09-10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address valid… |
CVE-2018-14620 | Medium | 4.7 | 2018-09-10 | The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |
CVE-2018-16733 | High | 7.5 | 2018-09-08 | In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. |
CVE-2018-16454 | High | 7.5 | 2018-09-07 | PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted comma. |
CVE-2018-15483 | High | 7.5 | 2018-09-07 | An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04. |
CVE-2018-0658 | High | 7.2 | 2018-09-07 | Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Mo… |
CVE-2018-6320 | Critical | 9.8 | 2018-09-06 | A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure… |
CVE-2018-5391 | High | 7.5 | 2018-09-06 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An… |
CVE-2018-1000773 | High | 8.8 | 2018-09-06 | WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an… |
CVE-2018-14624 | High | 7.5 | 2018-09-06 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when r… |
CVE-2017-1000600 | High | 8.8 | 2018-09-06 | WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears t… |
CVE-2016-1000232 | Medium | 5.3 | 2018-09-05 | NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Servic… |
CVE-2018-13259 | Critical | 9.8 | 2018-09-05 | An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that i… |
CVE-2018-0502 | Critical | 9.8 | 2018-09-05 | An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the se… |
CVE-2018-10930 | Medium | 6.5 | 2018-09-04 | A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the… |
CVE-2018-10929 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute… |
CVE-2018-10927 | High | 8.1 | 2018-09-04 | A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote… |
CVE-2018-10926 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrar… |
CVE-2018-10923 | High | 8.1 | 2018-09-04 | It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use t… |
CVE-2018-0664 | Critical | 9.8 | 2018-09-04 | A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors. |
CVE-2018-16238 | High | 7.2 | 2018-08-30 | An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI… |
CVE-2018-16231 | High | 7.5 | 2018-08-30 | Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an unspecified sequence o… |
CVE-2018-14619 | High | 7.8 | 2018-08-30 | A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was fre… |
CVE-2018-11615 | High | 7.5 | 2018-08-30 | This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne… |
CVE-2018-8022 | High | 7.5 | 2018-08-29 | A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6… |
CVE-2018-1318 | High | 7.5 | 2018-08-29 | Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0… |
CVE-2018-12807 | Medium | 5.3 | 2018-08-29 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. Successful exploitation could lead to unauthorized… |
CVE-2017-15426 | Medium | 6.5 | 2018-08-28 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a… |
CVE-2017-15425 | Medium | 6.5 | 2018-08-28 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a… |
CVE-2017-15424 | Medium | 6.5 | 2018-08-28 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a… |
CVE-2017-15420 | Medium | 6.5 | 2018-08-28 | Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of t… |
CVE-2015-9264 | Critical | 9.8 | 2018-08-27 | Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service. |