CWE-20 · Improper Input Validation (page 82)
Page 82 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12313 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to ex… |
CVE-2017-12312 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute… |
CVE-2017-12311 | Medium | 5.8 | 2017-11-16 | A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media pro… |
CVE-2017-12300 | Medium | 5.8 | 2017-11-16 | A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that i… |
CVE-2017-12299 | Medium | 5.3 | 2017-11-16 | A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Services that could all… |
CVE-2017-16837 | High | 7.8 | 2017-11-16 | Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite… |
CVE-2014-0219 | Medium | 5.5 | 2017-11-15 | Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shu… |
CVE-2017-15270 | Medium | 5.3 | 2017-11-15 | The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file. This can be used by attackers to h… |
CVE-2017-14961 | High | 7.8 | 2017-11-15 | In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8300000c. |
CVE-2017-8815 | High | 7.5 | 2017-11-15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules. |
CVE-2017-8814 | High | 7.5 | 2017-11-15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule defin… |
CVE-2017-8811 | Medium | 6.1 | 2017-11-15 | The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks. |
CVE-2017-11863 | Medium | 6.1 | 2017-11-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user in… |
CVE-2017-14388 | High | 7.8 | 2017-11-13 | Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume… |
CVE-2017-13849 | Medium | 5.5 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involve… |
CVE-2017-13809 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "AppleScript" component. It allows remote attackers… |
CVE-2017-13807 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Audio" component. It allows remote attackers to ex… |
CVE-2017-13804 | Medium | 5.5 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before… |
CVE-2017-13790 | Medium | 6.5 | 2017-11-13 | An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to s… |
CVE-2017-13789 | Medium | 6.5 | 2017-11-13 | An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to s… |
CVE-2017-12802 | Medium | 6.5 | 2017-11-10 | The EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted… |
CVE-2017-12801 | Medium | 6.5 | 2017-11-10 | The UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mk… |
CVE-2017-12783 | Medium | 6.5 | 2017-11-10 | The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv… |
CVE-2017-12782 | Medium | 6.5 | 2017-11-10 | The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file. |
CVE-2017-11461 | Medium | 4.3 | 2017-11-10 | NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" which could be used… |
CVE-2017-16637 | Medium | 4.4 | 2017-11-06 | In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN connection, a critica… |
CVE-2017-14025 | Medium | 5.5 | 2017-11-06 | An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified, allowing a local… |
CVE-2017-14023 | Medium | 4.9 | 2017-11-06 | An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions. The improper i… |
CVE-2017-11177 | High | 7.5 | 2017-11-06 | TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory. |
CVE-2017-16547 | High | 8.8 | 2017-11-06 | The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows… |
CVE-2017-16538 | Medium | 6.6 | 2017-11-04 | drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system… |
CVE-2017-16237 | High | 7.8 | 2017-11-03 | In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability because of not validating input values fr… |
CVE-2017-12277 | High | 8.8 | 2017-11-02 | A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance… |
CVE-2017-12276 | High | 8.1 | 2017-11-02 | A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated… |
CVE-2017-12275 | High | 7.4 | 2017-11-02 | A vulnerability in the implementation of 802.11v Basic Service Set (BSS) Transition Management functionality in Cisco Wireless LAN Controllers could allow an u… |
CVE-2017-12274 | Medium | 6.5 | 2017-11-02 | A vulnerability in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allo… |
CVE-2017-12273 | Medium | 6.5 | 2017-11-02 | A vulnerability in 802.11 association request frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an unauthenticated… |
CVE-2017-1000122 | Medium | 5.3 | 2017-11-01 | The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary proce… |
CVE-2017-14992 | Medium | 6.5 | 2017-11-01 | Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and ea… |
CVE-2017-10953 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to e… |
CVE-2017-14919 | High | 7.5 | 2017-10-30 | Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging… |
CVE-2014-0072 | High | 7.5 | 2017-10-30 | ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugi… |
CVE-2013-4366 | Critical | 9.8 | 2017-10-30 | http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers t… |
CVE-2009-1197 | Medium | 5.3 | 2017-10-30 | Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. |
CVE-2016-3090 | High | 8.8 | 2017-10-30 | The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression… |
CVE-2017-16227 | High | 7.5 | 2017-10-29 | The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages… |
CVE-2017-15956 | High | 7.5 | 2017-10-29 | ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php. |
CVE-2017-15951 | High | 7.8 | 2017-10-28 | The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to av… |
CVE-2015-1835 | Medium | 5.3 | 2017-10-27 | Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify und… |
CVE-2017-15928 | High | 7.5 | 2017-10-27 | In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox shou… |
CVE-2017-14182 | Medium | 6.5 | 2017-10-27 | A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, vi… |
CVE-2017-5121 | High | 8.8 | 2017-10-27 | Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary… |
CVE-2017-5110 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… |
CVE-2017-5109 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remo… |
CVE-2017-5106 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5105 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5104 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via… |
CVE-2017-5099 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privil… |
CVE-2017-5097 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memor… |
CVE-2017-5093 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote att… |
CVE-2017-5092 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform… |
CVE-2017-5090 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted d… |
CVE-2017-5089 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted d… |
CVE-2017-5086 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via… |
CVE-2017-5083 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5081 | Low | 3.3 | 2017-10-27 | Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed… |
CVE-2017-5079 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5076 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote a… |
CVE-2017-5072 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in Omnibox in Google Chrome prior to 59.0.3071.92 for Android allowed a remote attacker to perform domain spoofing with RTL charac… |
CVE-2017-5071 | Medium | 6.3 | 2017-10-27 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remo… |
CVE-2017-5067 | Medium | 6.5 | 2017-10-27 | An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents… |
CVE-2017-5065 | Medium | 4.7 | 2017-10-27 | Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially c… |
CVE-2017-15879 | High | 8.8 | 2017-10-24 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-bet… |
CVE-2017-1210 | High | 7.5 | 2017-10-24 | IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitim… |
CVE-2017-14696 | High | 7.5 | 2017-10-24 | SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted aut… |
CVE-2015-6839 | Medium | 4.6 | 2017-10-23 | The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multip… |
CVE-2017-7126 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7125 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7124 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7123 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7122 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7121 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7119 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "IOFireWireFamily" component. It allows attackers to… |
CVE-2017-7118 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Messages" component. It allows remote attackers to cause… |
CVE-2017-7106 | Medium | 6.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue… |
CVE-2017-7085 | Medium | 6.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "Safari" component. It allow… |
CVE-2017-7083 | Medium | 4.9 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is a… |
CVE-2017-7074 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "AppSandbox" component. It allows attackers to cause… |
CVE-2017-7072 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "iBooks" component. It allows remote attackers to cause a… |
CVE-2013-6049 | High | 7.8 | 2017-10-20 | apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors. |
CVE-2017-6141 | Medium | 5.9 | 2017-10-20 | In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a clien… |
CVE-2017-2132 | High | 7.5 | 2017-10-20 | Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to delete arbitrary files in a specific directory via unspe… |
CVE-2017-15651 | Medium | 6.7 | 2017-10-20 | PRTG Network Monitor 17.3.33.2830 allows remote authenticated administrators to execute arbitrary code by uploading a .exe file and then proceeding in spite of… |
CVE-2017-10955 | High | 8.8 | 2017-10-19 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. Authentication is requir… |
CVE-2017-12301 | Medium | 6.7 | 2017-10-19 | A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and gain una… |
CVE-2017-12287 | Medium | 4.3 | 2017-10-19 | A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS)… |
CVE-2017-12286 | Medium | 5.5 | 2017-10-19 | A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected softwa… |
CVE-2017-12285 | Medium | 5.3 | 2017-10-19 | A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from a… |
CVE-2015-2156 | High | 7.5 | 2017-10-18 | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow r… |
CVE-2017-15591 | Medium | 6.5 | 2017-10-18 | An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS cr… |