CWE-20 · Improper Input Validation (page 77)
Page 77 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1321 | High | 7.2 | 2018-03-20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x whic… |
CVE-2018-1294 | High | 7.5 | 2018-03-20 | If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains lin… |
CVE-2018-7511 | Medium | 5.3 | 2018-03-20 | In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow rem… |
CVE-2017-17215 | High | 8.8 | 2018-03-20 | Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to l… |
CVE-2018-4843 | Medium | 6.5 | 2018-03-20 | A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3)… |
CVE-2018-8821 | Medium | 5.5 | 2018-03-20 | windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file. |
CVE-2018-1221 | High | 8.1 | 2018-03-19 | In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers… |
CVE-2017-18240 | Medium | 5.5 | 2018-03-19 | The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill a… |
CVE-2018-8765 | High | 7.8 | 2018-03-18 | In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2017-18065 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in… |
CVE-2017-18060 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_… |
CVE-2017-18059 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_sc… |
CVE-2017-18058 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wow_buf_pkt_len i… |
CVE-2017-18057 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nl… |
CVE-2017-18055 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vd… |
CVE-2017-18054 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entr… |
CVE-2017-18053 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_i… |
CVE-2017-18052 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for cmpl_params->num_… |
CVE-2017-18051 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in… |
CVE-2017-18050 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_t… |
CVE-2017-15831 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_ndp_end_indication_event_ha… |
CVE-2018-1199 | Medium | 5.3 | 2018-03-16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0… |
CVE-2018-1078 | Critical | 9.8 | 2018-03-16 | OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or shoul… |
CVE-2017-18067 | Critical | 9.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an e… |
CVE-2017-18064 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2p_noa_info in w… |
CVE-2017-18063 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nlo_event in wma_… |
CVE-2017-18056 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_un… |
CVE-2017-14878 | High | 7.5 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a length variable which is used to copy data ha… |
CVE-2017-18235 | Medium | 5.5 | 2018-03-15 | An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights… |
CVE-2017-12194 | Critical | 9.8 | 2018-03-14 | A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this… |
CVE-2018-8711 | Critical | 9.8 | 2018-03-14 | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode p… |
CVE-2018-7531 | Medium | 5.9 | 2018-03-14 | An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests… |
CVE-2018-0888 | Medium | 5.6 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2… |
CVE-2018-0885 | Medium | 5.8 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 160… |
CVE-2018-0868 | High | 7.0 | 2018-03-14 | Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2018-1000125 | Critical | 9.8 | 2018-03-13 | inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JW… |
CVE-2018-6298 | Critical | 9.8 | 2018-03-13 | Remote code execution in Hanwha Techwin Smartcams |
CVE-2018-1000081 | High | 7.5 | 2018-03-13 | Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appe… |
CVE-2018-1000077 | Medium | 5.3 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2017-6281 | High | 7.8 | 2018-03-12 | NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilege. This issue is rat… |
CVE-2018-8065 | High | 7.5 | 2018-03-12 | An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory regi… |
CVE-2018-8050 | Medium | 6.5 | 2018-03-11 | The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation f… |
CVE-2018-7237 | Critical | 9.1 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete… |
CVE-2018-7235 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2018-7233 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7232 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7231 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2016-8786 | High | 7.5 | 2018-03-09 | Huawei S12700 V200R005C00, V200R006C00, V200R007C00, V200R008C00, S5700 V200R006C00, V200R007C00, V200R008C00, S6700 V200R008C00, S7700 V200R001C00, V200R002C0… |
CVE-2016-8785 | Medium | 4.3 | 2018-03-09 | Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R007C00 have an inp… |
CVE-2016-9606 | High | 8.1 | 2018-03-09 | JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which co… |
CVE-2016-8612 | Medium | 4.3 | 2018-03-09 | Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer res… |
CVE-2016-0276 | Medium | 6.3 | 2018-03-09 | IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Se… |
CVE-2017-17304 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17226 | Medium | 5.3 | 2018-03-09 | The TripAdvisor app with the versions before TAMobileApp-24.6.4 pre-installed in some Huawei mobile phones have an arbitrary URL loading vulnerability due to i… |
CVE-2017-17222 | High | 8.8 | 2018-03-09 | Import Language Package function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenti… |
CVE-2017-17221 | High | 8.8 | 2018-03-09 | Import Signal Tone function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenticated… |
CVE-2017-17219 | Medium | 5.3 | 2018-03-09 | SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R… |
CVE-2017-17170 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17169 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17168 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17148 | Medium | 5.5 | 2018-03-09 | Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific X… |
CVE-2018-0214 | Medium | 5.3 | 2018-03-08 | A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on t… |
CVE-2018-0213 | High | 8.8 | 2018-03-08 | A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated p… |
CVE-2018-0211 | Medium | 4.4 | 2018-03-08 | A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS)… |
CVE-2018-0147 | Critical | 9.8 | 2018-03-08 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote at… |
CVE-2018-7753 | Critical | 9.8 | 2018-03-07 | An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Us… |
CVE-2017-18221 | Medium | 5.5 | 2018-03-07 | The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption)… |
CVE-2018-7739 | Critical | 9.8 | 2018-03-07 | antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by… |
CVE-2017-8164 | Low | 3.3 | 2018-03-05 | Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-… |
CVE-2017-17138 | Medium | 5.5 | 2018-03-05 | PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C… |
CVE-2018-7560 | High | 7.5 | 2018-03-04 | index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted mult… |
CVE-2018-7583 | High | 7.5 | 2018-03-04 | Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. |
CVE-2018-7449 | High | 7.5 | 2018-03-04 | SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command. |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2018-1058 | High | 8.8 | 2018-03-02 | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to… |
CVE-2018-6490 | Medium | 5.9 | 2018-03-02 | Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could be remotely exploited to allow Denial… |
CVE-2018-1169 | High | 8.8 | 2018-03-02 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is require… |
CVE-2017-9270 | High | 8.7 | 2018-03-01 | In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database. |
CVE-2017-9269 | High | 7.7 | 2018-03-01 | In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to u… |
CVE-2017-7436 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious serve… |
CVE-2017-7435 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious serve… |
CVE-2017-14804 | Critical | 9.9 | 2018-03-01 | The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target… |
CVE-2017-6154 | High | 7.5 | 2018-03-01 | On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when process… |
CVE-2017-6150 | High | 7.5 | 2018-03-01 | Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default… |
CVE-2018-7549 | High | 7.5 | 2018-02-27 | In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. |
CVE-2017-15136 | Low | 2.7 | 2018-02-27 | When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered syst… |
CVE-2017-7671 | High | 7.5 | 2018-02-27 | There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the s… |
CVE-2017-5660 | High | 8.6 | 2018-02-27 | There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when in… |
CVE-2017-16813 | Medium | 5.5 | 2018-02-26 | A denial-of-service issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs when a user uploads a file that includes a hexadecimal Unic… |
CVE-2017-18200 | Medium | 5.5 | 2018-02-26 | The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_bios calls, which allows local users to c… |
CVE-2017-15817 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 bytes, the host dr… |
CVE-2014-3206 | Critical | 9.8 | 2018-02-23 | Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name paramet… |
CVE-2018-0139 | High | 8.6 | 2018-02-22 | A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could allow an unauthenti… |
CVE-2013-0267 | High | 8.8 | 2018-02-21 | The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nod… |
CVE-2018-1166 | High | 7.8 | 2018-02-21 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker m… |
CVE-2015-2081 | Critical | 9.8 | 2018-02-20 | Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts. |
CVE-2018-5763 | Medium | 5.9 | 2018-02-19 | An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker is able to bring th… |
CVE-2011-3477 | Medium | 5.5 | 2018-02-19 | GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Nor… |
CVE-2018-7208 | High | 7.8 | 2018-02-18 | In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not… |
CVE-2018-5767 | Critical | 9.8 | 2018-02-15 | An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted… |