CWE-20 · Improper Input Validation (page 81)
Page 81 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5503 | High | 7.5 | 2018-03-22 | On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual server with an asso… |
CVE-2018-5731 | High | 7.0 | 2018-03-22 | An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP… |
CVE-2017-16772 | High | 8.8 | 2018-03-22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authentic… |
CVE-2018-8904 | High | 7.8 | 2018-03-22 | In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or… |
CVE-2018-8896 | High | 7.8 | 2018-03-22 | In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-8895 | High | 7.8 | 2018-03-22 | In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-8894 | High | 7.8 | 2018-03-22 | In 2345 Security Guard 3.6, the driver file (2345BdPcSafe.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2017-0917 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2018-8876 | High | 7.8 | 2018-03-20 | In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2018-8875 | High | 7.8 | 2018-03-20 | In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2018-8874 | High | 7.8 | 2018-03-20 | In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2018-8873 | High | 7.8 | 2018-03-20 | In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2014-2032 | Medium | 5.9 | 2018-03-20 | Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out… |
CVE-2018-1321 | High | 7.2 | 2018-03-20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x whic… |
CVE-2018-1294 | High | 7.5 | 2018-03-20 | If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains lin… |
CVE-2018-7511 | Medium | 5.3 | 2018-03-20 | In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow rem… |
CVE-2017-17215 | High | 8.8 | 2018-03-20 | Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to l… |
CVE-2018-4843 | Medium | 6.5 | 2018-03-20 | A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3)… |
CVE-2018-8821 | Medium | 5.5 | 2018-03-20 | windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file. |
CVE-2018-1221 | High | 8.1 | 2018-03-19 | In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers… |
CVE-2017-18240 | Medium | 5.5 | 2018-03-19 | The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill a… |
CVE-2018-8765 | High | 7.8 | 2018-03-18 | In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2017-18065 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in… |
CVE-2017-18060 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_… |
CVE-2017-18059 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_sc… |
CVE-2017-18058 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wow_buf_pkt_len i… |
CVE-2017-18057 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nl… |
CVE-2017-18055 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vd… |
CVE-2017-18054 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entr… |
CVE-2017-18053 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_i… |
CVE-2017-18052 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for cmpl_params->num_… |
CVE-2017-18051 | High | 7.5 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in… |
CVE-2017-18050 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_t… |
CVE-2017-15831 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_ndp_end_indication_event_ha… |
CVE-2018-1199 | Medium | 5.3 | 2018-03-16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0… |
CVE-2018-1078 | Critical | 9.8 | 2018-03-16 | OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or shoul… |
CVE-2017-18067 | Critical | 9.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an e… |
CVE-2017-18064 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2p_noa_info in w… |
CVE-2017-18063 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nlo_event in wma_… |
CVE-2017-18056 | High | 7.8 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_un… |
CVE-2017-14878 | High | 7.5 | 2018-03-15 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a length variable which is used to copy data ha… |
CVE-2017-18235 | Medium | 5.5 | 2018-03-15 | An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights… |
CVE-2017-12194 | Critical | 9.8 | 2018-03-14 | A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this… |
CVE-2018-8711 | Critical | 9.8 | 2018-03-14 | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode p… |
CVE-2018-7531 | Medium | 5.9 | 2018-03-14 | An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests… |
CVE-2018-0888 | Medium | 5.6 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2… |
CVE-2018-0885 | Medium | 5.8 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 160… |
CVE-2018-0868 | High | 7.0 | 2018-03-14 | Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2018-1000125 | Critical | 9.8 | 2018-03-13 | inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JW… |
CVE-2018-6298 | Critical | 9.8 | 2018-03-13 | Remote code execution in Hanwha Techwin Smartcams |
CVE-2018-1000081 | High | 7.5 | 2018-03-13 | Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appe… |
CVE-2018-1000077 | Medium | 5.3 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2017-6281 | High | 7.8 | 2018-03-12 | NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilege. This issue is rat… |
CVE-2018-8065 | High | 7.5 | 2018-03-12 | An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory regi… |
CVE-2018-8050 | Medium | 6.5 | 2018-03-11 | The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation f… |
CVE-2018-7237 | Critical | 9.1 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete… |
CVE-2018-7235 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2018-7233 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7232 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7231 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2016-8786 | High | 7.5 | 2018-03-09 | Huawei S12700 V200R005C00, V200R006C00, V200R007C00, V200R008C00, S5700 V200R006C00, V200R007C00, V200R008C00, S6700 V200R008C00, S7700 V200R001C00, V200R002C0… |
CVE-2016-8785 | Medium | 4.3 | 2018-03-09 | Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R007C00 have an inp… |
CVE-2016-9606 | High | 8.1 | 2018-03-09 | JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which co… |
CVE-2016-8612 | Medium | 4.3 | 2018-03-09 | Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer res… |
CVE-2016-0276 | Medium | 6.3 | 2018-03-09 | IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Se… |
CVE-2017-17304 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17226 | Medium | 5.3 | 2018-03-09 | The TripAdvisor app with the versions before TAMobileApp-24.6.4 pre-installed in some Huawei mobile phones have an arbitrary URL loading vulnerability due to i… |
CVE-2017-17222 | High | 8.8 | 2018-03-09 | Import Language Package function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenti… |
CVE-2017-17221 | High | 8.8 | 2018-03-09 | Import Signal Tone function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenticated… |
CVE-2017-17219 | Medium | 5.3 | 2018-03-09 | SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R… |
CVE-2017-17170 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17169 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17168 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17148 | Medium | 5.5 | 2018-03-09 | Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific X… |
CVE-2018-0214 | Medium | 5.3 | 2018-03-08 | A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on t… |
CVE-2018-0213 | High | 8.8 | 2018-03-08 | A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated p… |
CVE-2018-0211 | Medium | 4.4 | 2018-03-08 | A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS)… |
CVE-2018-0147 | Critical | 9.8 | 2018-03-08 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote at… |
CVE-2018-7753 | Critical | 9.8 | 2018-03-07 | An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Us… |
CVE-2017-18221 | Medium | 5.5 | 2018-03-07 | The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption)… |
CVE-2018-7739 | Critical | 9.8 | 2018-03-07 | antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by… |
CVE-2017-8164 | Low | 3.3 | 2018-03-05 | Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-… |
CVE-2017-17138 | Medium | 5.5 | 2018-03-05 | PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C… |
CVE-2018-7560 | High | 7.5 | 2018-03-04 | index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted mult… |
CVE-2018-7583 | High | 7.5 | 2018-03-04 | Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. |
CVE-2018-7449 | High | 7.5 | 2018-03-04 | SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command. |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2018-1058 | High | 8.8 | 2018-03-02 | A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to… |
CVE-2018-6490 | Medium | 5.9 | 2018-03-02 | Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could be remotely exploited to allow Denial… |
CVE-2018-1169 | High | 8.8 | 2018-03-02 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is require… |
CVE-2017-9270 | High | 8.7 | 2018-03-01 | In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database. |
CVE-2017-9269 | High | 7.7 | 2018-03-01 | In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to u… |
CVE-2017-7436 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious serve… |
CVE-2017-7435 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious serve… |
CVE-2017-14804 | Critical | 9.9 | 2018-03-01 | The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target… |
CVE-2017-6154 | High | 7.5 | 2018-03-01 | On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when process… |
CVE-2017-6150 | High | 7.5 | 2018-03-01 | Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default… |
CVE-2018-7549 | High | 7.5 | 2018-02-27 | In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. |