CWE-20 · Improper Input Validation (page 84)
Page 84 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000391 | High | 7.3 | 2018-01-26 | Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearin… |
CVE-2016-10710 | High | 8.1 | 2018-01-25 | Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authentic… |
CVE-2018-5447 | Critical | 9.8 | 2018-01-25 | An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified that affects a service… |
CVE-2018-1051 | High | 8.1 | 2018-01-25 | It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()`… |
CVE-2018-6217 | Medium | 5.5 | 2018-01-25 | The WStr::_alloc_iostr_data() function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 allows remote attackers to cause a denial of service (appl… |
CVE-2018-6209 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxCryptMon.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified oth… |
CVE-2018-6208 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-6207 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-6206 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-6205 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (MaxProtector32.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-6204 | High | 7.8 | 2018-01-25 | In Max Secure Anti Virus 19.0.3.019,, the driver file (SDActMon.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other… |
CVE-2018-6203 | High | 7.8 | 2018-01-25 | In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-6202 | High | 7.8 | 2018-01-25 | In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-6201 | High | 7.8 | 2018-01-25 | In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-1047 | Medium | 5.5 | 2018-01-24 | A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method… |
CVE-2017-12187 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12186 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12185 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly ex… |
CVE-2017-12184 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute ar… |
CVE-2017-12183 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12182 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12181 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12180 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly exec… |
CVE-2017-12178 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly… |
CVE-2017-12176 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or… |
CVE-2017-15697 | Critical | 9.8 | 2018-01-23 | A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to prope… |
CVE-2017-12632 | High | 7.5 | 2018-01-23 | A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to… |
CVE-2017-2750 | Critical | 9.8 | 2018-01-23 | Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide Enterprise printers… |
CVE-2017-15105 | Medium | 5.3 | 2018-01-23 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to pro… |
CVE-2017-15093 | Medium | 5.3 | 2018-01-23 | When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and… |
CVE-2017-16594 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2018-1000003 | Low | 3.7 | 2018-01-22 | Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some… |
CVE-2018-1000002 | Low | 3.7 | 2018-01-22 | Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny exis… |
CVE-2018-5958 | High | 7.8 | 2018-01-21 | In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact bec… |
CVE-2018-5957 | High | 7.8 | 2018-01-21 | In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact bec… |
CVE-2018-5956 | High | 7.8 | 2018-01-21 | In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact bec… |
CVE-2018-5955 | Critical | 9.8 | 2018-01-21 | An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a user to t… |
CVE-2017-7325 | High | 7.5 | 2018-01-19 | Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open. |
CVE-2017-17860 | Medium | 5.7 | 2018-01-18 | In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intentio… |
CVE-2017-12197 | Medium | 6.5 | 2018-01-18 | It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled acc… |
CVE-2018-0090 | High | 7.5 | 2018-01-18 | A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker… |
CVE-2017-5699 | Medium | 5.5 | 2018-01-18 | Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs. |
CVE-2018-5714 | High | 7.8 | 2018-01-16 | In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5713 | High | 7.8 | 2018-01-16 | In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2017-17429 | Medium | 5.5 | 2018-01-16 | In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity pro… |
CVE-2017-16556 | Medium | 5.5 | 2018-01-16 | In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations. |
CVE-2016-0215 | Medium | 6.5 | 2018-01-16 | IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon… |
CVE-2016-0207 | Medium | 5.4 | 2018-01-16 | IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors… |
CVE-2017-13214 | High | 7.5 | 2018-01-12 | In the hardware HEVC decoder, some media files could cause a page fault. This could lead to a remote denial of service of a critical system process with no add… |
CVE-2017-13198 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8… |
CVE-2017-13194 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-6471… |
CVE-2017-13186 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. A… |
CVE-2017-13176 | High | 8.8 | 2018-01-12 | In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a remote elevation of privilege that cou… |
CVE-2015-9246 | Critical | 9.8 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file i… |
CVE-2014-8166 | High | 8.8 | 2018-01-12 | The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbit… |
CVE-2017-2158 | Low | 3.3 | 2018-01-12 | Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially craft… |
CVE-2017-15845 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size (negative val… |
CVE-2014-5003 | Medium | 5.5 | 2018-01-10 | chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privi… |
CVE-2014-4994 | Medium | 5.5 | 2018-01-10 | lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-ba… |
CVE-2017-15124 | High | 7.5 | 2018-01-09 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle… |
CVE-2014-7222 | Medium | 6.5 | 2018-01-08 | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connecting to a ch… |
CVE-2014-1858 | Medium | 5.5 | 2018-01-08 | __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. |
CVE-2018-5279 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5278 | Low | 3.3 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5277 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5276 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5275 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5274 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5273 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5272 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5271 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5270 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2014-8336 | Medium | 6.5 | 2018-01-05 | The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveragin… |
CVE-2017-16753 | High | 7.5 | 2018-01-05 | An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to cras… |
CVE-2018-5220 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5219 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5218 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5217 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-0104 | Critical | 9.6 | 2018-01-04 | A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on th… |
CVE-2017-8046 | Critical | 9.8 | 2018-01-04 | Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot v… |
CVE-2017-18020 | High | 8.4 | 2018-01-04 | On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot o… |
CVE-2017-18019 | High | 7.1 | 2018-01-04 | In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to co… |
CVE-2018-5088 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5087 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5086 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5085 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5084 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5083 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5082 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5081 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5080 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5079 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2017-1000469 | Critical | 9.8 | 2018-01-03 | Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user. |
CVE-2017-1000423 | Critical | 9.8 | 2018-01-02 | b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenti… |
CVE-2014-8119 | High | 7.5 | 2017-12-29 | The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path exp… |
CVE-2017-17967 | Medium | 5.5 | 2017-12-28 | pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-35482. |
CVE-2017-17952 | High | 8.6 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed… |
CVE-2017-15667 | High | 7.5 | 2017-12-28 | In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to contro… |
CVE-2017-13056 | High | 7.8 | 2017-12-27 | The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file. |
CVE-2017-7154 | Medium | 6.6 | 2017-12-27 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. The issue invol… |