CWE-20 · Improper Input Validation (page 90)
Page 90 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9385 | Medium | 6.0 | 2017-01-23 | The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host cr… |
CVE-2016-9383 | High | 8.8 | 2017-01-23 | Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a den… |
CVE-2016-9380 | High | 7.5 | 2017-01-23 | The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbi… |
CVE-2016-9379 | High | 7.9 | 2017-01-23 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbit… |
CVE-2016-6603 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. |
CVE-2016-5119 | High | 7.5 | 2017-01-23 | The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response an… |
CVE-2016-4793 | High | 7.5 | 2017-01-23 | The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
CVE-2016-9436 | Medium | 6.5 | 2017-01-20 | parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file… |
CVE-2016-9435 | Medium | 6.5 | 2017-01-20 | The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application… |
CVE-2014-9755 | High | 7.5 | 2017-01-20 | The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the ch… |
CVE-2014-9754 | Medium | 5.9 | 2017-01-20 | The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the ch… |
CVE-2017-2576 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
CVE-2016-7543 | High | 8.4 | 2017-01-19 | Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. |
CVE-2015-8212 | Critical | 9.8 | 2017-01-19 | CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments… |
CVE-2016-5222 | Medium | 6.5 | 2017-01-19 | Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to… |
CVE-2016-5218 | Medium | 6.5 | 2017-01-19 | The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs… |
CVE-2016-5197 | High | 8.8 | 2017-01-19 | The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compro… |
CVE-2016-9278 | Medium | 5.5 | 2017-01-18 | The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a craf… |
CVE-2016-7998 | High | 8.8 | 2017-01-18 | The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a… |
CVE-2016-7434 | High | 7.5 | 2017-01-13 | The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. |
CVE-2016-7431 | Medium | 5.3 | 2017-01-13 | NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exist… |
CVE-2016-7791 | Critical | 9.8 | 2017-01-12 | Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the websit… |
CVE-2016-7790 | Critical | 9.8 | 2017-01-12 | Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_… |
CVE-2017-0389 | High | 7.5 | 2017-01-12 | A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. T… |
CVE-2016-8442 | High | 7.8 | 2017-01-12 | Possible unauthorized memory access in the hypervisor. Lack of input validation could allow hypervisor memory to be accessed by the HLOS. Product: Android. Ver… |
CVE-2016-8437 | Critical | 9.8 | 2017-01-12 | Improper input validation in Access Control APIs. Access control API may return memory range checking incorrectly. Product: Android. Versions: Kernel 3.18. And… |
CVE-2016-9444 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-9147 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a r… |
CVE-2016-9131 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2017-2947 | Medium | 5.5 | 2017-01-11 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have a security bypass vulnerability when manipulating Fo… |
CVE-2017-0004 | High | 7.5 | 2017-01-10 | The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote atta… |
CVE-2016-9247 | Medium | 5.9 | 2017-01-10 | Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets… |
CVE-2016-8106 | Medium | 5.9 | 2017-01-09 | A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker to stop the controll… |
CVE-2017-5217 | Medium | 5.5 | 2017-01-09 | Installing a zero-permission Android application on certain Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software can continually crash the sys… |
CVE-2016-4329 | Medium | 5.5 | 2017-01-06 | A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled w… |
CVE-2016-1547 | Medium | 5.3 | 2017-01-06 | An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f9… |
CVE-2016-5024 | Medium | 5.9 | 2017-01-03 | Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRule, allow remote att… |
CVE-2016-10100 | Medium | 5.3 | 2017-01-02 | Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recovery, potentially allowing an attacker to o… |
CVE-2015-8744 | Medium | 5.5 | 2016-12-29 | QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 pac… |
CVE-2016-9224 | Medium | 6.5 | 2016-12-26 | A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information… |
CVE-2016-8595 | Medium | 5.5 | 2016-12-23 | The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI… |
CVE-2016-7785 | Medium | 5.5 | 2016-12-23 | The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI… |
CVE-2016-9179 | High | 7.5 | 2016-12-22 | lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked int… |
CVE-2016-7267 | Medium | 5.5 | 2016-12-20 | Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbitrary code via a cr… |
CVE-2016-7266 | High | 7.8 | 2016-12-20 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 for Mac mi… |
CVE-2016-5193 | Medium | 4.3 | 2016-12-18 | Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navi… |
CVE-2016-5188 | Medium | 4.3 | 2016-12-18 | Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via cr… |
CVE-2016-5187 | Medium | 6.5 | 2016-12-18 | Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof… |
CVE-2016-9158 | High | 7.5 | 2016-12-17 | A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All… |
CVE-2016-8822 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000E, 0x6000… |
CVE-2016-8820 | Medium | 6.1 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a f… |
CVE-2016-8818 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a pointer passed from… |
CVE-2016-9212 | High | 7.5 | 2016-12-14 | A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an una… |
CVE-2016-9211 | High | 7.5 | 2016-12-14 | A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote attacker to cause t… |
CVE-2016-9207 | Medium | 6.5 | 2016-12-14 | A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitra… |
CVE-2016-9201 | High | 7.5 | 2016-12-14 | A vulnerability in the Zone-Based Firewall feature of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to pass traffic that… |
CVE-2016-9193 | High | 7.5 | 2016-12-14 | A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an u… |
CVE-2016-6465 | Medium | 4.3 | 2016-12-14 | A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances and Cisco Web Security Appliances could al… |
CVE-2016-7952 | High | 7.5 | 2016-12-13 | X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData… |
CVE-2016-7949 | Critical | 9.8 | 2016-12-13 | Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out… |
CVE-2016-6712 | Medium | 5.5 | 2016-12-13 | A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-0… |
CVE-2016-6711 | Medium | 5.5 | 2016-12-13 | A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-0… |
CVE-2016-5691 | Critical | 9.8 | 2016-12-13 | The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1)… |
CVE-2016-9863 | High | 7.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All… |
CVE-2016-9860 | Medium | 5.9 | 2016-12-11 | An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServe… |
CVE-2016-9859 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6… |
CVE-2016-9858 | Medium | 5.3 | 2016-12-11 | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature… |
CVE-2016-6630 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change passwo… |
CVE-2016-6623 | Medium | 6.5 | 2016-12-11 | An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x v… |
CVE-2016-6501 | Critical | 9.8 | 2016-12-09 | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poi… |
CVE-2016-6496 | Critical | 9.8 | 2016-12-09 | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute wit… |
CVE-2016-9919 | High | 7.5 | 2016-12-08 | The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to… |
CVE-2015-8870 | High | 7.4 | 2016-12-06 | Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly ob… |
CVE-2016-8740 | High | 7.5 | 2016-12-05 | The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header len… |
CVE-2016-9157 | Critical | 9.8 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to u… |
CVE-2016-9156 | High | 7.3 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the fil… |
CVE-2016-3044 | Medium | 6.5 | 2016-12-01 | The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite… |
CVE-2016-9564 | High | 7.5 | 2016-11-30 | Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' ch… |
CVE-2016-5987 | Medium | 5.3 | 2016-11-30 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sensitive information v… |
CVE-2016-2937 | Medium | 6.5 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related… |
CVE-2016-2935 | Medium | 5.3 | 2016-11-30 | The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request. |
CVE-2016-9191 | Medium | 5.5 | 2016-11-28 | The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service… |
CVE-2016-8650 | Medium | 5.5 | 2016-11-28 | The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users… |
CVE-2016-9452 | Medium | 6.5 | 2016-11-25 | The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. |
CVE-2016-2996 | Medium | 6.5 | 2016-11-24 | IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, allows remote authenticated users to append to arbitrary files v… |
CVE-2016-1248 | High | 7.8 | 2016-11-23 | vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary c… |
CVE-2016-6463 | Medium | 5.3 | 2016-11-19 | A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attac… |
CVE-2016-6462 | Medium | 5.3 | 2016-11-19 | A vulnerability in the email filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attac… |
CVE-2016-6461 | Medium | 5.9 | 2016-11-19 | A vulnerability in the HTTP web-based management interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to in… |
CVE-2016-6458 | High | 7.5 | 2016-11-19 | A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote att… |
CVE-2016-6450 | Low | 2.5 | 2016-11-19 | A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the… |
CVE-2016-4332 | High | 8.6 | 2016-11-18 | The library's failure to check if certain message types support a particular flag, the HDF5 1.8.16 library will cast the structure to an alternative structure… |
CVE-2016-9375 | Medium | 5.9 | 2016-11-17 | In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addr… |
CVE-2016-9372 | Medium | 5.9 | 2016-11-17 | In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/p… |
CVE-2016-0909 | High | 8.4 | 2016-11-15 | EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially b… |
CVE-2016-7209 | Medium | 5.3 | 2016-11-10 | Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." |
CVE-2016-8809 | High | 7.8 | 2016-11-08 | For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the k… |
CVE-2016-5025 | Medium | 6.6 | 2016-11-08 | For the NVIDIA Quadro, NVS, and GeForce products, improper sanitization of parameters in the NVAPI support layer causes a denial of service vulnerability (blue… |
CVE-2016-4961 | Medium | 5.5 | 2016-11-08 | For the NVIDIA Quadro, NVS, and GeForce products, improper sanitization of parameters in the NVStreamKMS.sys API layer caused a denial of service vulnerability… |
CVE-2016-4960 | High | 7.3 | 2016-11-08 | For the NVIDIA Quadro, NVS, and GeForce products, the NVIDIA NVStreamKMS.sys service component is improperly validating user-supplied data through its API entr… |