CWE-20 · Improper Input Validation (page 78)
Page 78 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-4202 | Medium | 5.9 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "iBooks" component. It… |
CVE-2018-4198 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before… |
CVE-2018-4188 | Medium | 6.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTu… |
CVE-2018-4187 | Medium | 6.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. The issue involves… |
CVE-2014-0593 | High | 7.8 | 2018-06-08 | The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this scri… |
CVE-2018-12065 | Critical | 9.8 | 2018-06-08 | A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP c… |
CVE-2018-12046 | High | 7.5 | 2018-06-08 | DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str param… |
CVE-2018-12041 | High | 7.5 | 2018-06-08 | An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0. Attackers can remotely deny service by sending specially constructed 8… |
CVE-2018-0355 | Medium | 6.1 | 2018-06-07 | A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scr… |
CVE-2018-0338 | High | 7.8 | 2018-06-07 | A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to e… |
CVE-2018-0296 | High | 7.5 | 2018-06-07 | A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device… |
CVE-2018-0274 | High | 8.8 | 2018-06-07 | A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell command… |
CVE-2018-3723 | High | 8.8 | 2018-06-07 | defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the… |
CVE-2018-3719 | High | 8.8 | 2018-06-07 | mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pro… |
CVE-2017-16226 | Critical | 9.8 | 2018-06-07 | The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global funct… |
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2018-3852 | High | 7.5 | 2018-06-06 | An exploitable denial of service vulnerability exists in the Ocularis Recorder functionality of Ocularis 5.5.0.242. A specially crafted TCP packet can cause a… |
CVE-2018-1268 | Medium | 6.8 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not va… |
CVE-2018-11808 | Critical | 9.1 | 2018-06-06 | Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any fi… |
CVE-2017-7653 | Medium | 5.3 | 2018-06-05 | The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject… |
CVE-2018-11678 | Critical | 9.8 | 2018-06-05 | plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie. |
CVE-2016-9042 | Medium | 5.9 | 2018-06-04 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network… |
CVE-2017-16026 | Medium | 5.9 | 2018-06-04 | Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is pas… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |
CVE-2017-16005 | High | 7.5 | 2018-06-04 | Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not th… |
CVE-2018-1002100 | Medium | 4.2 | 2018-06-02 | In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container… |
CVE-2018-5522 | Medium | 5.9 | 2018-06-01 | On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pai… |
CVE-2018-5513 | High | 7.5 | 2018-06-01 | On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a di… |
CVE-2017-17171 | Medium | 4.2 | 2018-06-01 | Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters. An attacker may trick a target… |
CVE-2016-10555 | Medium | 6.5 | 2018-05-31 | Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If th… |
CVE-2016-10544 | Medium | 5.9 | 2018-05-31 | uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used c… |
CVE-2016-10543 | Medium | 5.3 | 2018-05-31 | call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, w… |
CVE-2016-10542 | High | 7.5 | 2018-05-31 | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly… |
CVE-2016-10540 | High | 7.5 | 2018-05-31 | Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, patt… |
CVE-2016-10539 | High | 7.5 | 2018-05-31 | negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", wh… |
CVE-2016-10521 | High | 7.5 | 2018-05-31 | jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator. |
CVE-2016-10520 | High | 7.5 | 2018-05-31 | jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2015-9239 | High | 7.5 | 2018-05-31 | ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2018-11481 | High | 8.8 | 2018-05-30 | TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr… |
CVE-2018-11518 | High | 8.1 | 2018-05-30 | A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based… |
CVE-2018-10995 | Medium | 5.3 | 2018-05-30 | SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields). |
CVE-2018-11548 | High | 7.5 | 2018-05-29 | An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address. |
CVE-2015-9242 | High | 7.5 | 2018-05-29 | Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash… |
CVE-2015-9241 | High | 7.5 | 2018-05-29 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 e… |
CVE-2015-9235 | Critical | 9.8 | 2018-05-29 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES fami… |
CVE-2018-11479 | High | 7.8 | 2018-05-25 | The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pi… |
CVE-2018-1137 | High | 8.1 | 2018-05-25 | An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged… |
CVE-2018-5487 | Critical | 9.8 | 2018-05-24 | NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to… |
CVE-2017-17315 | Medium | 5.3 | 2018-05-24 | Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V10… |
CVE-2017-17158 | Medium | 4.6 | 2018-05-24 | Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the v… |
CVE-2018-1000040 | Medium | 5.5 | 2018-05-24 | In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or… |
CVE-2018-1000037 | Medium | 5.5 | 2018-05-24 | In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafte… |
CVE-2018-11411 | High | 7.5 | 2018-05-24 | The transferFrom function of a smart contract implementation for DimonCoin (FUD), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all… |
CVE-2018-8176 | High | 8.8 | 2018-05-23 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoi… |
CVE-2018-11357 | High | 7.5 | 2018-05-22 | In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbu… |
CVE-2018-11354 | High | 7.5 | 2018-05-22 | In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string ha… |
CVE-2017-2617 | High | 7.6 | 2018-05-22 | hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which cou… |
CVE-2018-11321 | Medium | 6.5 | 2018-05-22 | An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filt… |
CVE-2018-11367 | High | 7.5 | 2018-05-22 | An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module. |
CVE-2018-11315 | Medium | 6.5 | 2018-05-20 | The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remot… |
CVE-2018-4992 | High | 7.8 | 2018-05-19 | Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper input validation vulnerability. Successful exploitation co… |
CVE-2018-4943 | High | 8.8 | 2018-05-19 | Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to Jav… |
CVE-2018-8867 | High | 7.5 | 2018-05-18 | In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 al… |
CVE-2018-11232 | Medium | 5.5 | 2018-05-18 | The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service… |
CVE-2018-9970 | High | 8.8 | 2018-05-17 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to ex… |
CVE-2018-9935 | High | 8.8 | 2018-05-17 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2018-7159 | Medium | 5.3 | 2018-05-17 | The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interprete… |
CVE-2018-0325 | High | 7.5 | 2018-05-17 | A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones… |
CVE-2018-0280 | High | 7.5 | 2018-05-17 | A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to c… |
CVE-2018-0279 | High | 8.8 | 2018-05-17 | A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker… |
CVE-2018-4850 | High | 7.5 | 2018-05-16 | A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMATIC S7-400 (incl. F) CPU hardware versio… |
CVE-2018-3634 | Medium | 5.5 | 2018-05-15 | Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local access. |
CVE-2018-3611 | Medium | 6.5 | 2018-05-15 | Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial of service via local… |
CVE-2017-14439 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14438 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-12124 | Medium | 6.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-6021 | High | 7.5 | 2018-05-14 | In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build… |
CVE-2018-11035 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-11034 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-3612 | High | 7.8 | 2018-05-10 | Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM). |
CVE-2018-10977 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10976 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10975 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10974 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10955 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10954 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10953 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10952 | High | 7.8 | 2018-05-10 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-2416 | Medium | 5.4 | 2018-05-09 | SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source. |
CVE-2018-0961 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data, aka "Hyper-V vSMB Remote Code E… |
CVE-2018-0959 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-10828 | Medium | 5.5 | 2018-05-09 | An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object… |
CVE-2018-10830 | High | 7.8 | 2018-05-09 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-1000168 | High | 7.5 | 2018-05-08 | nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segment… |
CVE-2018-10809 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-10799 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.loc… |
CVE-2018-10798 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the re… |
CVE-2018-10796 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-10776 | High | 7.8 | 2018-05-07 | The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application… |