CWE-20 · Improper Input Validation (page 86)
Page 86 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2713 | Medium | 5.4 | 2017-11-22 | HUAWEI P9 smartphones with software versions earlier before EVA-L09C432B383, versions earlier before EVA-L09C636B380, versions earlier before VIE-L09C432B370… |
CVE-2017-2711 | Medium | 5.5 | 2017-11-22 | P9 Plus smartphones with software earlier than VIE-AL10C00B352 versions have an input validation vulnerability in the touchscreen Driver. An attacker can trick… |
CVE-2017-2709 | Medium | 5.5 | 2017-11-22 | HiGame with software earlier than 7.3.0 versions, SkyTone with software earlier than 8.1.1 versions have a DoS Vulnerability. An attacker tricks a user into in… |
CVE-2017-11402 | Critical | 9.8 | 2017-11-20 | An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. Design flaws in OPC classic and in custom netfilter modul… |
CVE-2017-1000230 | High | 7.5 | 2017-11-17 | The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are prov… |
CVE-2017-16845 | Critical | 10.0 | 2017-11-17 | hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access. |
CVE-2017-13703 | High | 7.5 | 2017-11-17 | An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur. |
CVE-2017-1000169 | Critical | 9.8 | 2017-11-17 | QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takeover of the server… |
CVE-2017-1000247 | High | 7.5 | 2017-11-17 | British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resul… |
CVE-2017-1000228 | Critical | 9.8 | 2017-11-17 | nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function |
CVE-2017-1000189 | High | 7.5 | 2017-11-17 | nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile() |
CVE-2017-1000201 | Medium | 5.5 | 2017-11-17 | The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack |
CVE-2017-0858 | High | 7.5 | 2017-11-16 | Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894. |
CVE-2017-11027 | High | 7.8 | 2017-11-16 | In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing UBI image, size is not validated… |
CVE-2017-4931 | High | 7.8 | 2017-11-16 | VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's lo… |
CVE-2017-12313 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to ex… |
CVE-2017-12312 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute… |
CVE-2017-12311 | Medium | 5.8 | 2017-11-16 | A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media pro… |
CVE-2017-12300 | Medium | 5.8 | 2017-11-16 | A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that i… |
CVE-2017-12299 | Medium | 5.3 | 2017-11-16 | A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Services that could all… |
CVE-2017-16837 | High | 7.8 | 2017-11-16 | Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite… |
CVE-2014-0219 | Medium | 5.5 | 2017-11-15 | Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shu… |
CVE-2017-15270 | Medium | 5.3 | 2017-11-15 | The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) file. This can be used by attackers to h… |
CVE-2017-14961 | High | 7.8 | 2017-11-15 | In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8300000c. |
CVE-2017-8815 | High | 7.5 | 2017-11-15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules. |
CVE-2017-8814 | High | 7.5 | 2017-11-15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule defin… |
CVE-2017-8811 | Medium | 6.1 | 2017-11-15 | The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks. |
CVE-2017-11863 | Medium | 6.1 | 2017-11-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user in… |
CVE-2017-14388 | High | 7.8 | 2017-11-13 | Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume… |
CVE-2017-13849 | Medium | 5.5 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involve… |
CVE-2017-13809 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "AppleScript" component. It allows remote attackers… |
CVE-2017-13807 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Audio" component. It allows remote attackers to ex… |
CVE-2017-13804 | Medium | 5.5 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before… |
CVE-2017-13790 | Medium | 6.5 | 2017-11-13 | An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to s… |
CVE-2017-13789 | Medium | 6.5 | 2017-11-13 | An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to s… |
CVE-2017-12802 | Medium | 6.5 | 2017-11-10 | The EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted… |
CVE-2017-12801 | Medium | 6.5 | 2017-11-10 | The UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mk… |
CVE-2017-12783 | Medium | 6.5 | 2017-11-10 | The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv… |
CVE-2017-12782 | Medium | 6.5 | 2017-11-10 | The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file. |
CVE-2017-11461 | Medium | 4.3 | 2017-11-10 | NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" which could be used… |
CVE-2017-16637 | Medium | 4.4 | 2017-11-06 | In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN connection, a critica… |
CVE-2017-14025 | Medium | 5.5 | 2017-11-06 | An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified, allowing a local… |
CVE-2017-14023 | Medium | 4.9 | 2017-11-06 | An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions. The improper i… |
CVE-2017-11177 | High | 7.5 | 2017-11-06 | TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory. |
CVE-2017-16547 | High | 8.8 | 2017-11-06 | The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows… |
CVE-2017-16538 | Medium | 6.6 | 2017-11-04 | drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system… |
CVE-2017-16237 | High | 7.8 | 2017-11-03 | In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability because of not validating input values fr… |
CVE-2017-12277 | High | 8.8 | 2017-11-02 | A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance… |
CVE-2017-12276 | High | 8.1 | 2017-11-02 | A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated… |
CVE-2017-12275 | High | 7.4 | 2017-11-02 | A vulnerability in the implementation of 802.11v Basic Service Set (BSS) Transition Management functionality in Cisco Wireless LAN Controllers could allow an u… |
CVE-2017-12274 | Medium | 6.5 | 2017-11-02 | A vulnerability in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allo… |
CVE-2017-12273 | Medium | 6.5 | 2017-11-02 | A vulnerability in 802.11 association request frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an unauthenticated… |
CVE-2017-1000122 | Medium | 5.3 | 2017-11-01 | The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary proce… |
CVE-2017-14992 | Medium | 6.5 | 2017-11-01 | Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and ea… |
CVE-2017-10953 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to e… |
CVE-2017-14919 | High | 7.5 | 2017-10-30 | Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging… |
CVE-2014-0072 | High | 7.5 | 2017-10-30 | ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugi… |
CVE-2013-4366 | Critical | 9.8 | 2017-10-30 | http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers t… |
CVE-2009-1197 | Medium | 5.3 | 2017-10-30 | Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. |
CVE-2016-3090 | High | 8.8 | 2017-10-30 | The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression… |
CVE-2017-16227 | High | 7.5 | 2017-10-29 | The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages… |
CVE-2017-15956 | High | 7.5 | 2017-10-29 | ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php. |
CVE-2017-15951 | High | 7.8 | 2017-10-28 | The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to av… |
CVE-2015-1835 | Medium | 5.3 | 2017-10-27 | Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify und… |
CVE-2017-15928 | High | 7.5 | 2017-10-27 | In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox shou… |
CVE-2017-14182 | Medium | 6.5 | 2017-10-27 | A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, vi… |
CVE-2017-5121 | High | 8.8 | 2017-10-27 | Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary… |
CVE-2017-5110 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… |
CVE-2017-5109 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remo… |
CVE-2017-5106 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5105 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5104 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via… |
CVE-2017-5099 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privil… |
CVE-2017-5097 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memor… |
CVE-2017-5093 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote att… |
CVE-2017-5092 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform… |
CVE-2017-5090 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted d… |
CVE-2017-5089 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted d… |
CVE-2017-5086 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via… |
CVE-2017-5083 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5081 | Low | 3.3 | 2017-10-27 | Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed… |
CVE-2017-5079 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5076 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote a… |
CVE-2017-5072 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in Omnibox in Google Chrome prior to 59.0.3071.92 for Android allowed a remote attacker to perform domain spoofing with RTL charac… |
CVE-2017-5071 | Medium | 6.3 | 2017-10-27 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remo… |
CVE-2017-5067 | Medium | 6.5 | 2017-10-27 | An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents… |
CVE-2017-5065 | Medium | 4.7 | 2017-10-27 | Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially c… |
CVE-2017-15879 | High | 8.8 | 2017-10-24 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-bet… |
CVE-2017-1210 | High | 7.5 | 2017-10-24 | IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitim… |
CVE-2017-14696 | High | 7.5 | 2017-10-24 | SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted aut… |
CVE-2015-6839 | Medium | 4.6 | 2017-10-23 | The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multip… |
CVE-2017-7126 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7125 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7124 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7123 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7122 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7121 | Critical | 9.8 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before 5.30 allo… |
CVE-2017-7119 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "IOFireWireFamily" component. It allows attackers to… |
CVE-2017-7118 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Messages" component. It allows remote attackers to cause… |
CVE-2017-7106 | Medium | 6.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue… |