CWE-20 · Improper Input Validation (page 93)
Page 93 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0475 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the recovery verifier could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0463 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the conte… |
CVE-2017-0458 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-9727 | High | 8.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker cou… |
CVE-2016-9726 | High | 8.8 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted reque… |
CVE-2016-9693 | Medium | 6.1 | 2017-03-07 | IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unau… |
CVE-2016-6247 | Medium | 5.5 | 2017-03-07 | OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist. |
CVE-2016-6246 | Medium | 4.4 | 2017-03-07 | OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in… |
CVE-2016-6243 | Medium | 5.5 | 2017-03-07 | thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of… |
CVE-2016-6239 | Medium | 5.5 | 2017-03-07 | The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value. |
CVE-2016-6244 | High | 7.5 | 2017-03-07 | The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_s… |
CVE-2017-6504 | Medium | 6.1 | 2017-03-06 | WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. |
CVE-2017-6498 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS. |
CVE-2017-6473 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c b… |
CVE-2017-6471 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in… |
CVE-2017-6469 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addresse… |
CVE-2017-6468 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/n… |
CVE-2016-7407 | Critical | 9.8 | 2017-03-03 | The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file. |
CVE-2016-7406 | Critical | 9.8 | 2017-03-03 | Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username o… |
CVE-2016-10069 | Medium | 5.5 | 2017-03-02 | coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of fr… |
CVE-2016-10068 | Medium | 5.5 | 2017-03-02 | The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted… |
CVE-2016-10228 | Medium | 5.9 | 2017-03-02 | The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGN… |
CVE-2017-3826 | High | 7.5 | 2017-03-01 | A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software before 1.1(1a) could a… |
CVE-2017-6345 | High | 7.8 | 2017-03-01 | The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cau… |
CVE-2016-9830 | Medium | 5.5 | 2017-03-01 | The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg ima… |
CVE-2016-5240 | Medium | 5.5 | 2017-02-27 | The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of… |
CVE-2016-9009 | Low | 3.1 | 2017-02-24 | IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #… |
CVE-2017-6188 | Medium | 5.5 | 2017-02-22 | Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file… |
CVE-2017-5586 | Critical | 9.8 | 2017-02-22 | OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to… |
CVE-2017-3844 | Medium | 4.3 | 2017-02-22 | A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file… |
CVE-2017-3843 | Medium | 4.3 | 2017-02-22 | A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files t… |
CVE-2017-3837 | High | 8.1 | 2017-02-22 | An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authe… |
CVE-2017-3830 | High | 7.5 | 2017-02-22 | A vulnerability in an internal API of the Cisco Meeting Server (CMS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi… |
CVE-2017-3827 | Medium | 5.8 | 2017-02-22 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Securit… |
CVE-2017-6078 | Medium | 5.5 | 2017-02-21 | FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize f… |
CVE-2017-2371 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to l… |
CVE-2017-2368 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "Contacts" component. It allows remote attackers to ca… |
CVE-2017-2351 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate at… |
CVE-2016-7742 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "xar" component, which allows remote attackers to e… |
CVE-2016-7667 | High | 7.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "CoreText" component… |
CVE-2016-7665 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Graphics Driver" component, which allows remote attacke… |
CVE-2016-7657 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7636 | Medium | 5.9 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7581 | Medium | 4.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. The issue involves the "Safari" component, which allows remote web servers to c… |
CVE-2016-7580 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to… |
CVE-2016-4690 | Medium | 6.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Image Capture" component, which allows attackers to exe… |
CVE-2016-4669 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS befor… |
CVE-2016-4661 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ntfs" component, which misparses disk images and a… |
CVE-2016-9955 | Medium | 6.3 | 2017-02-17 | The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly… |
CVE-2016-8652 | Medium | 5.9 | 2017-02-17 | The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authent… |
CVE-2017-0318 | Medium | 5.5 | 2017-02-15 | All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may ca… |
CVE-2017-0312 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where u… |
CVE-2016-8944 | Medium | 5.5 | 2017-02-15 | IBM AIX 7.1 and 7.2 allows a local user to open a file with a specially crafted argument that would crash the system. IBM APARs: IV91488, IV91487, IV91456, IV9… |
CVE-2016-8344 | Low | 3.7 | 2017-02-13 | An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion… |
CVE-2016-5782 | High | 8.6 | 2017-02-13 | An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to… |
CVE-2016-6129 | High | 7.5 | 2017-02-13 | The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the… |
CVE-2016-4547 | High | 7.5 | 2017-02-13 | Samsung devices with Android KK(4.4), L(5.0/5.1), or M(6.0) allow attackers to cause a denial of service (system crash) via a crafted system call to TvoutServi… |
CVE-2016-4546 | Medium | 5.5 | 2017-02-13 | Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service crash) via crafted data in a service cal… |
CVE-2017-3896 | Medium | 5.9 | 2017-02-13 | Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attacke… |
CVE-2017-5858 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5606 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5605 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5604 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5603 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5602 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5593 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5592 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5591 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5590 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5589 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2016-9686 | Medium | 5.3 | 2017-02-08 | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing comm… |
CVE-2016-0206 | Low | 3.3 | 2017-02-08 | IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and… |
CVE-2017-0422 | High | 7.5 | 2017-02-08 | A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This… |
CVE-2016-7164 | High | 7.5 | 2017-02-07 | The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and crash) via a crafted… |
CVE-2016-6131 | High | 7.5 | 2017-02-07 | The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of… |
CVE-2016-2781 | Medium | 4.6 | 2017-02-07 | chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes character… |
CVE-2016-5102 | Medium | 5.5 | 2017-02-06 | Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (segmenta… |
CVE-2010-5328 | Medium | 5.5 | 2017-02-06 | include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which a… |
CVE-2017-5880 | Medium | 6.5 | 2017-02-04 | Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0… |
CVE-2016-6500 | High | 8.1 | 2017-02-03 | Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnO… |
CVE-2017-3822 | Medium | 5.3 | 2017-02-03 | A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense (FTD) Firepower Device Manager (FDM) could allow an unauthenticated, remote atta… |
CVE-2017-3818 | Medium | 5.8 | 2017-02-03 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an… |
CVE-2017-3814 | Medium | 5.8 | 2017-02-03 | A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certa… |
CVE-2017-3809 | Medium | 5.8 | 2017-02-03 | A vulnerability in the Policy deployment module of the Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to prevent deplo… |
CVE-2016-6234 | Medium | 5.5 | 2017-02-02 | The process_file function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (crash) via a crafted jpeg file. |
CVE-2016-6084 | Medium | 6.5 | 2017-02-01 | IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request. |
CVE-2017-3792 | Critical | 9.8 | 2017-02-01 | A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remot… |
CVE-2017-3790 | High | 8.6 | 2017-02-01 | A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauth… |
CVE-2016-10079 | High | 7.5 | 2017-02-01 | SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515. |
CVE-2016-4038 | High | 7.8 | 2017-02-01 | Array index error in the msm_sensor_config function in kernel/SM-G9008V_CHN_KK_Opensource/Kernel/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c in Sa… |
CVE-2016-9420 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comp… |
CVE-2016-9249 | High | 7.5 | 2017-01-31 | An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, re… |
CVE-2016-6267 | High | 8.8 | 2017-01-30 | SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to e… |
CVE-2016-6266 | High | 8.8 | 2017-01-30 | ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated… |
CVE-2016-9939 | High | 7.5 | 2017-01-30 | Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length f… |
CVE-2016-2517 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of… |
CVE-2016-2516 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP addre… |
CVE-2015-8138 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero. |
CVE-2016-10176 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special U… |
CVE-2017-3323 | Low | 3.7 | 2017-01-27 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.25 and earlier, 7.3… |