CWE-20 · Improper Input Validation (page 76)
Page 76 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0349 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2018-0345 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary co… |
CVE-2018-10616 | High | 7.8 | 2018-07-18 | ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer wh… |
CVE-2017-18103 | Medium | 4.7 | 2018-07-18 | The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Bro… |
CVE-2018-14361 | Critical | 9.8 | 2018-07-17 | An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data. |
CVE-2018-14351 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. |
CVE-2018-14349 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. |
CVE-2017-15137 | Medium | 4.3 | 2018-07-16 | The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with… |
CVE-2018-0385 | High | 7.5 | 2018-07-16 | A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthentica… |
CVE-2018-0369 | High | 8.6 | 2018-07-16 | A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacke… |
CVE-2018-0361 | Low | 3.3 | 2018-07-16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. |
CVE-2018-14071 | Critical | 9.8 | 2018-07-16 | The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. |
CVE-2018-14089 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <=… |
CVE-2018-14085 | High | 7.5 | 2018-07-16 | An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that th… |
CVE-2018-14055 | Medium | 6.5 | 2018-07-15 | ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue v… |
CVE-2016-9494 | Medium | 6.5 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's adv… |
CVE-2016-6567 | Critical | 9.8 | 2018-07-13 | SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some… |
CVE-2016-6565 | High | 7.5 | 2018-07-13 | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request… |
CVE-2016-6542 | Low | 3.7 | 2018-07-13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the d… |
CVE-2018-13796 | Medium | 6.5 | 2018-07-12 | An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. |
CVE-2018-14009 | Critical | 9.8 | 2018-07-12 | Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. |
CVE-2017-18155 | High | 7.8 | 2018-07-12 | While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, an uninit… |
CVE-2018-0037 | Critical | 9.8 | 2018-07-11 | Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages… |
CVE-2018-0034 | Medium | 5.3 | 2018-07-11 | A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted… |
CVE-2018-0032 | High | 7.5 | 2018-07-11 | The receipt of a crafted BGP UPDATE can lead to a routing process daemon (RPD) crash and restart. Repeated receipt of the same crafted BGP UPDATE can result in… |
CVE-2018-0027 | High | 7.5 | 2018-07-11 | Receipt of a crafted or malformed RSVP PATH message may cause the routing protocol daemon (RPD) to hang or crash. When RPD is unavailable, routing updates cann… |
CVE-2018-8007 | High | 7.2 | 2018-07-11 | Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration setti… |
CVE-2018-8311 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remot… |
CVE-2018-8300 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka "Microso… |
CVE-2018-8260 | High | 8.8 | 2018-07-11 | A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framework Remote Code Exe… |
CVE-2018-8232 | High | 7.8 | 2018-07-11 | A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering Vulnerability." This affect… |
CVE-2018-2439 | Medium | 5.9 | 2018-07-10 | The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for a… |
CVE-2018-10891 | High | 7.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is… |
CVE-2018-10943 | High | 7.5 | 2018-07-10 | An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3. Sending an arbitrary unexpected string to TCP port 7100… |
CVE-2018-10888 | Medium | 6.5 | 2018-07-10 | A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading… |
CVE-2018-13389 | Medium | 4.7 | 2018-07-10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attach… |
CVE-2018-13795 | High | 7.5 | 2018-07-09 | Gravity before 0.5.1 does not support a maximum recursion depth. |
CVE-2018-1000617 | High | 7.5 | 2018-07-09 | Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can… |
CVE-2017-3197 | Critical | 9.8 | 2018-07-09 | GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PR… |
CVE-2018-3597 | High | 7.8 | 2018-07-06 | In the ADSP RPC driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-… |
CVE-2018-13348 | High | 7.5 | 2018-07-06 | The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the curr… |
CVE-2018-13346 | High | 7.5 | 2018-07-06 | The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, ak… |
CVE-2017-16816 | Medium | 6.5 | 2018-07-05 | The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by le… |
CVE-2018-8038 | High | 7.5 | 2018-07-05 | Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the ap… |
CVE-2018-10885 | Medium | 6.5 | 2018-07-05 | In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An… |
CVE-2018-9242 | Medium | 5.5 | 2018-07-03 | The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete file… |
CVE-2018-3753 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can co… |
CVE-2018-3752 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can co… |
CVE-2018-3751 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can… |
CVE-2018-3750 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can cont… |
CVE-2018-3749 | Critical | 9.8 | 2018-07-03 | The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part… |
CVE-2018-11316 | Critical | 9.6 | 2018-07-03 | The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and priv… |
CVE-2018-11314 | Critical | 9.6 | 2018-07-03 | The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privilege… |
CVE-2018-7635 | Medium | 5.3 | 2018-07-03 | Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows… |
CVE-2018-7787 | Medium | 5.3 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTT… |
CVE-2018-7784 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a comm… |
CVE-2018-7777 | High | 8.8 | 2018-07-03 | The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software version… |
CVE-2018-4851 | High | 8.2 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause… |
CVE-2018-10843 | High | 8.5 | 2018-07-02 | source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalat… |
CVE-2018-13056 | High | 7.5 | 2018-07-02 | An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table… |
CVE-2018-10874 | High | 7.8 | 2018-07-02 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allo… |
CVE-2017-17175 | Medium | 6.5 | 2018-07-02 | Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerabil… |
CVE-2018-12999 | High | 7.5 | 2018-06-29 | Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server witho… |
CVE-2018-12988 | High | 7.5 | 2018-06-29 | GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI. |
CVE-2018-5528 | Medium | 5.3 | 2018-06-27 | Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. |
CVE-2018-3840 | High | 7.5 | 2018-06-26 | A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing of a network packet… |
CVE-2018-1374 | Medium | 5.3 | 2018-06-26 | An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) client connecting to a Q… |
CVE-2018-12712 | High | 8.8 | 2018-06-26 | An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP… |
CVE-2018-1000607 | Medium | 6.5 | 2018-06-26 | A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rul… |
CVE-2018-1000533 | Critical | 9.8 | 2018-06-26 | klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result i… |
CVE-2018-1000531 | High | 7.5 | 2018-06-26 | inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an… |
CVE-2018-1000523 | High | 8.1 | 2018-06-26 | topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a… |
CVE-2018-1000205 | Medium | 5.5 | 2018-06-26 | U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack ap… |
CVE-2018-0529 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2018-11046 | Medium | 6.5 | 2018-06-25 | Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker wi… |
CVE-2017-9312 | High | 7.5 | 2018-06-25 | Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a c… |
CVE-2018-12703 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers to steal assets (e.g… |
CVE-2018-12702 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackers to steal assets… |
CVE-2018-12694 | High | 7.5 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json. |
CVE-2018-12688 | Critical | 9.8 | 2018-06-22 | tinyexr 0.9.5 has a segmentation fault in the wav2Decode function. |
CVE-2017-7466 | High | 8.0 | 2018-06-22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client syste… |
CVE-2018-12635 | High | 7.5 | 2018-06-22 | CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. |
CVE-2018-7679 | Critical | 9.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not valida… |
CVE-2017-2669 | Low | 3.7 | 2018-06-21 | Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the I… |
CVE-2018-0373 | Medium | 5.5 | 2018-06-21 | A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could all… |
CVE-2018-0371 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2018-0337 | High | 7.8 | 2018-06-21 | A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2018-0331 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol (formerly known as CDP) subsystem of devices running, or based on, Cisco NX-OS Software contain a vulnerability… |
CVE-2018-0313 | High | 8.8 | 2018-06-21 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interf… |
CVE-2018-0306 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected dev… |
CVE-2018-0303 | High | 8.8 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2018-0302 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buf… |
CVE-2018-0299 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, rem… |
CVE-2018-0298 | High | 7.5 | 2018-06-21 | A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overfl… |
CVE-2018-0314 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services (CFS) component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to… |
CVE-2018-0312 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0308 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0307 | High | 7.8 | 2018-06-20 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. Th… |
CVE-2018-0304 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to read… |
CVE-2018-0301 | Critical | 9.8 | 2018-06-20 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on… |