CWE-20 · Improper Input Validation (page 85)
Page 85 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17862 | Medium | 5.5 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, als… |
CVE-2017-17850 | High | 7.5 | 2017-12-27 | An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dia… |
CVE-2017-17846 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long stri… |
CVE-2017-13858 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute a… |
CVE-2017-13848 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute a… |
CVE-2017-14022 | High | 7.5 | 2017-12-23 | An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker w… |
CVE-2017-15324 | High | 7.5 | 2017-12-22 | Huawei S5700 and S6700 with software of V200R005C00 have a DoS vulnerability due to insufficient validation of the Network Quality Analysis (NQA) packets. A re… |
CVE-2017-15322 | Medium | 6.5 | 2017-12-22 | Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validat… |
CVE-2017-15310 | Medium | 6.5 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerabilit… |
CVE-2017-15308 | High | 8.8 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker… |
CVE-2017-10908 | High | 7.5 | 2017-12-22 | H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header. |
CVE-2017-10868 | High | 7.5 | 2017-12-22 | H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header. |
CVE-2017-6164 | High | 8.1 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12… |
CVE-2017-6140 | High | 7.5 | 2017-12-21 | On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 1… |
CVE-2017-6138 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests mad… |
CVE-2017-6136 | Medium | 5.9 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic pa… |
CVE-2017-6134 | Medium | 6.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an un… |
CVE-2017-6133 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests m… |
CVE-2017-6132 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11… |
CVE-2017-6129 | High | 7.5 | 2017-12-21 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or caus… |
CVE-2017-17831 | High | 8.8 | 2017-12-21 | GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "… |
CVE-2017-17810 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles m… |
CVE-2017-17805 | High | 7.8 | 2017-12-20 | The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_A… |
CVE-2017-1696 | High | 8.8 | 2017-12-20 | IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an atta… |
CVE-2017-14968 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14967 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14966 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14965 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14964 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14963 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-17804 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-17803 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17802 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17801 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17800 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17799 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17798 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17797 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-17796 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17795 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-15103 | High | 8.8 | 2017-12-18 | A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to… |
CVE-2017-14583 | Medium | 6.5 | 2017-12-18 | NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (Do… |
CVE-2017-3191 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that… |
CVE-2016-10703 | High | 7.5 | 2017-12-14 | A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attac… |
CVE-2017-17537 | High | 7.5 | 2017-12-13 | MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data t… |
CVE-2017-14589 | Critical | 9.6 | 2017-12-13 | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration right… |
CVE-2017-17565 | Medium | 5.6 | 2017-12-12 | An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in p… |
CVE-2017-11936 | High | 8.8 | 2017-12-12 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint E… |
CVE-2017-11932 | High | 8.1 | 2017-12-12 | Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web… |
CVE-2017-11885 | Medium | 6.6 | 2017-12-12 | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serv… |
CVE-2017-16691 | Medium | 6.5 | 2017-12-12 | SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of t… |
CVE-2017-17551 | High | 8.8 | 2017-12-11 | The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore brow… |
CVE-2017-15944 | Critical | 9.8 | 2017-12-11 | Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via… |
CVE-2017-10897 | Medium | 4.5 | 2017-12-08 | Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device… |
CVE-2017-15121 | Medium | 5.5 | 2017-12-07 | A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned… |
CVE-2017-13148 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717… |
CVE-2017-0878 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291. |
CVE-2017-0877 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937. |
CVE-2017-0876 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675. |
CVE-2017-0874 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-6331593… |
CVE-2017-0873 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316… |
CVE-2017-0872 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323. |
CVE-2017-15868 | High | 7.8 | 2017-12-05 | The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows l… |
CVE-2017-14914 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can beco… |
CVE-2017-14909 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not p… |
CVE-2017-14908 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the SafeSwitch test application does not proper… |
CVE-2017-15707 | Medium | 6.2 | 2017-12-01 | In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious reques… |
CVE-2017-17086 | Critical | 9.8 | 2017-12-01 | Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to cause a denial of service (crash) or po… |
CVE-2017-17065 | High | 7.5 | 2017-11-30 | An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles the authentication values for HNAP. An a… |
CVE-2017-12367 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and… |
CVE-2017-12355 | Medium | 5.3 | 2017-11-30 | A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow an unauthenticated, r… |
CVE-2017-12338 | Medium | 6.0 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerabili… |
CVE-2017-12336 | Medium | 4.2 | 2017-11-30 | A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell… |
CVE-2017-12334 | Medium | 6.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would… |
CVE-2017-12328 | Medium | 5.8 | 2017-11-30 | A vulnerability in Session Initiation Protocol (SIP) call handling in Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cau… |
CVE-2017-12297 | Medium | 5.0 | 2017-11-30 | A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to arbitrary hosts, aka a "URL Redirection… |
CVE-2017-16952 | Medium | 5.5 | 2017-11-28 | KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file. |
CVE-2017-16951 | Medium | 5.5 | 2017-11-28 | Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file. |
CVE-2017-8019 | High | 7.5 | 2017-11-28 | An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM, SDS, and LIA) could potentially allow an unauthenticated remote attack… |
CVE-2017-1001004 | High | 8.8 | 2017-11-27 | typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result… |
CVE-2017-1001003 | Critical | 9.8 | 2017-11-27 | math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. |
CVE-2017-16935 | Critical | 9.8 | 2017-11-24 | Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions vi… |
CVE-2017-8186 | Medium | 5.5 | 2017-11-22 | The Bastet of some Huawei mobile phones with software of earlier than MHA-AL00BC00B231 versions has a DOS vulnerability due to the lack of parameter validation… |
CVE-2017-8175 | Medium | 5.5 | 2017-11-22 | The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than Warsa… |
CVE-2017-8167 | High | 7.5 | 2017-11-22 | Huawei firewall products USG9500 V500R001C50 has a DoS vulnerability.A remote attacker who controls the peer device could exploit the vulnerability by sending… |
CVE-2017-8147 | High | 7.5 | 2017-11-22 | AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C20SPC026T,AR200 with software V200R005C… |
CVE-2017-8146 | Medium | 5.5 | 2017-11-22 | The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167… |
CVE-2017-8145 | Medium | 5.5 | 2017-11-22 | The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167… |
CVE-2017-8143 | Medium | 5.5 | 2017-11-22 | Wi-Fi driver of Honor 5C and P9 Lite Huawei smart phones with software versions earlier than NEM-L21C432B351 and versions earlier than VNS-L21C10B381 has a DoS… |
CVE-2017-8129 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters… |
CVE-2017-8128 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters… |
CVE-2017-8126 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker… |
CVE-2017-8124 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker… |
CVE-2017-8123 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker… |
CVE-2017-8122 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker… |
CVE-2017-8120 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters… |
CVE-2017-8119 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters… |
CVE-2017-8117 | Critical | 9.8 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters… |
CVE-2017-2731 | Medium | 5.5 | 2017-11-22 | The vibrator service in P9 Plus smart phones with software versions earlier before VIE-AL10C00B386 has DoS vulnerability. An attacker can tricks a user into in… |
CVE-2017-2722 | High | 8.8 | 2017-11-22 | DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPo… |