CWE-20 · Improper Input Validation (page 88)
Page 88 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-8273 | High | 7.8 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software packa… |
CVE-2015-8670 | Medium | 6.5 | 2017-04-02 | Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service. |
CVE-2015-7847 | Medium | 5.5 | 2017-04-02 | Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerabil… |
CVE-2015-7844 | High | 7.5 | 2017-04-02 | Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud de… |
CVE-2014-8572 | High | 7.5 | 2017-04-02 | Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S2300, S3300, S2700, S… |
CVE-2017-6974 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the system-installation subsystem of the "System Integr… |
CVE-2017-2479 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTune… |
CVE-2017-2461 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2453 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It a… |
CVE-2017-2442 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit JavaScript Bindi… |
CVE-2017-2434 | Critical | 9.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "HomeKit" component. It allows attackers to have an unsp… |
CVE-2017-2414 | Medium | 5.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "DataAccess" component. It allows remote attackers to ac… |
CVE-2017-2410 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute… |
CVE-2017-2378 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "We… |
CVE-2017-7394 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames. |
CVE-2016-6560 | High | 8.6 | 2017-03-31 | illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. |
CVE-2017-7346 | Medium | 5.5 | 2017-03-30 | The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, w… |
CVE-2017-5185 | High | 7.5 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service. |
CVE-2014-9815 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted wpg file. |
CVE-2014-9813 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted viff file. |
CVE-2014-9811 | Medium | 5.5 | 2017-03-30 | The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file. |
CVE-2014-9810 | Medium | 5.5 | 2017-03-30 | The dpx file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed dpx file. |
CVE-2014-9809 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted xwd image. |
CVE-2014-9808 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted dpc image. |
CVE-2014-9806 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (file descriptor consumption) via a crafted file. |
CVE-2014-9805 | Medium | 5.5 | 2017-03-30 | ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted pnm file. |
CVE-2017-5226 | Critical | 10.0 | 2017-03-29 | When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into th… |
CVE-2017-7301 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an of… |
CVE-2015-4556 | High | 7.5 | 2017-03-29 | The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash). |
CVE-2009-5147 | High | 7.3 | 2017-03-29 | DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names. |
CVE-2017-7183 | High | 7.5 | 2017-03-27 | The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP protocol mes… |
CVE-2017-6464 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive. |
CVE-2017-6463 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config d… |
CVE-2017-5932 | High | 7.8 | 2017-03-27 | The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a comma… |
CVE-2017-7262 | Medium | 5.5 | 2017-03-25 | The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service (system hang) via an application that makes a l… |
CVE-2017-7261 | Medium | 5.5 | 2017-03-24 | The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain… |
CVE-2016-6206 | Critical | 9.8 | 2017-03-24 | Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted packet. |
CVE-2015-8678 | Medium | 5.5 | 2017-03-24 | The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL… |
CVE-2016-9395 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted fil… |
CVE-2016-9394 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted fil… |
CVE-2016-9390 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted ima… |
CVE-2016-9168 | Medium | 6.5 | 2017-03-23 | A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking. |
CVE-2016-5755 | Medium | 6.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high enc… |
CVE-2017-7235 | High | 8.8 | 2017-03-23 | An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any… |
CVE-2017-3858 | High | 8.8 | 2017-03-22 | A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with… |
CVE-2017-3852 | High | 8.1 | 2017-03-22 | A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attack… |
CVE-2017-3850 | Medium | 5.9 | 2017-03-21 | A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software (15.4 through 15.6) and Cisco IOS XE Software (3.7 through 3.18… |
CVE-2017-3849 | High | 7.4 | 2017-03-21 | A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and Cisco IOS XE Software… |
CVE-2016-4927 | High | 8.1 | 2017-03-20 | Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with man… |
CVE-2016-6816 | High | 7.1 | 2017-03-20 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line pe… |
CVE-2017-6837 | Medium | 5.5 | 2017-03-20 | WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coef… |
CVE-2014-9851 | High | 7.5 | 2017-03-20 | ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash). |
CVE-2017-3881 | Critical | 9.8 | 2017-03-17 | A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote at… |
CVE-2017-3875 | Medium | 5.3 | 2017-03-17 | An Access-Control Filtering Mechanisms Bypass vulnerability in certain access-control filtering mechanisms on Cisco Nexus 7000 Series Switches could allow an u… |
CVE-2014-8705 | Critical | 9.8 | 2017-03-17 | PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook param… |
CVE-2017-6961 | Medium | 5.5 | 2017-03-17 | An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to… |
CVE-2017-6955 | Medium | 5.3 | 2017-03-17 | An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of… |
CVE-2017-0148 | High | 8.1 | 2017-03-17 | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8… |
CVE-2017-0109 | High | 7.6 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and… |
CVE-2017-0099 | Medium | 5.4 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511… |
CVE-2017-0098 | Medium | 5.4 | 2017-03-17 | Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service… |
CVE-2017-0097 | Medium | 5.4 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607… |
CVE-2017-0095 | High | 7.6 | 2017-03-17 | Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arb… |
CVE-2017-0076 | Medium | 5.4 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607… |
CVE-2017-0074 | Medium | 5.4 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607… |
CVE-2017-0069 | Medium | 4.3 | 2017-03-17 | Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." This vulnerability is differen… |
CVE-2017-0033 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi… |
CVE-2017-0012 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi… |
CVE-2017-0007 | Medium | 5.5 | 2017-03-17 | Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associa… |
CVE-2017-3846 | High | 8.6 | 2017-03-15 | A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticated, remote attacker… |
CVE-2017-5359 | High | 7.5 | 2017-03-15 | EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI. |
CVE-2016-10167 | Medium | 5.5 | 2017-03-15 | The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (appl… |
CVE-2017-6440 | Medium | 5.0 | 2017-03-15 | The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a craf… |
CVE-2017-6436 | Medium | 5.0 | 2017-03-15 | The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a cr… |
CVE-2016-8017 | Medium | 4.1 | 2017-03-14 | Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read f… |
CVE-2017-6516 | Medium | 6.7 | 2017-03-14 | A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated priv… |
CVE-2017-6367 | High | 7.5 | 2017-03-14 | In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack methodology involves a long Host header and an invalid… |
CVE-2014-9645 | Medium | 5.5 | 2017-03-12 | The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (sl… |
CVE-2017-6815 | Medium | 6.1 | 2017-03-12 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
CVE-2017-6466 | High | 8.1 | 2017-03-11 | F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrit… |
CVE-2017-5872 | High | 7.5 | 2017-03-10 | The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1… |
CVE-2017-0499 | Medium | 5.5 | 2017-03-08 | A denial of service vulnerability in Audioserver could enable a local malicious application to cause a device hang or reboot. This issue is rated as Low due to… |
CVE-2017-0488 | Medium | 5.5 | 2017-03-08 | A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated… |
CVE-2017-0484 | Medium | 5.5 | 2017-03-08 | A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated… |
CVE-2017-0483 | Medium | 5.5 | 2017-03-08 | A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated… |
CVE-2017-0475 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the recovery verifier could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0463 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the conte… |
CVE-2017-0458 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-9727 | High | 8.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker cou… |
CVE-2016-9726 | High | 8.8 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted reque… |
CVE-2016-9693 | Medium | 6.1 | 2017-03-07 | IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unau… |
CVE-2016-6247 | Medium | 5.5 | 2017-03-07 | OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist. |
CVE-2016-6246 | Medium | 4.4 | 2017-03-07 | OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in… |
CVE-2016-6243 | Medium | 5.5 | 2017-03-07 | thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of… |
CVE-2016-6239 | Medium | 5.5 | 2017-03-07 | The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value. |
CVE-2016-6244 | High | 7.5 | 2017-03-07 | The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_s… |
CVE-2017-6504 | Medium | 6.1 | 2017-03-06 | WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. |
CVE-2017-6498 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS. |
CVE-2017-6473 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c b… |
CVE-2017-6471 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in… |