CWE-755 · Improper Handling of Exceptional Conditions (page 6)
Page 6 of 6 — CVEs classified under CWE-755, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17195 | Critical | 9.8 | 2019-10-15 | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential informa… |
CVE-2019-1376 | Medium | 6.5 | 2019-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Manage… |
CVE-2019-1342 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting Manager El… |
CVE-2019-1313 | Medium | 6.5 | 2019-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Manage… |
CVE-2019-0060 | High | 7.5 | 2019-10-09 | The flowd process, responsible for forwarding traffic in SRX Series services gateways, may crash and restart when processing specific transit IP packets throug… |
CVE-2019-0051 | Medium | 6.5 | 2019-10-09 | SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS servers to crash the flowd daemon. Rep… |
CVE-2019-15894 | Medium | 6.8 | 2019-10-07 | An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses… |
CVE-2019-16866 | High | 7.5 | 2019-10-03 | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the q… |
CVE-2019-12677 | Medium | 6.5 | 2019-10-02 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker… |
CVE-2019-8462 | High | 7.5 | 2019-10-02 | In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enha… |
CVE-2019-16930 | Medium | 5.3 | 2019-09-28 | Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during dese… |
CVE-2019-0203 | High | 7.5 | 2019-09-26 | In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences o… |
CVE-2019-16901 | High | 7.5 | 2019-09-26 | Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from ntdll!RtlRaiseStat… |
CVE-2019-6830 | Medium | 5.9 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an… |
CVE-2019-6829 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which… |
CVE-2019-6828 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Prem… |
CVE-2019-6809 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon… |
CVE-2019-9009 | High | 7.5 | 2019-09-17 | An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash. |
CVE-2019-11777 | High | 7.5 | 2019-09-11 | In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verific… |
CVE-2019-14431 | Critical | 9.8 | 2019-07-29 | In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and… |
CVE-2019-14378 | High | 8.8 | 2019-07-29 | ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. |
CVE-2019-2241 | Medium | 5.5 | 2019-07-25 | While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI beh… |
CVE-2019-2240 | Medium | 5.5 | 2019-07-25 | While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredictable behaviour in Snapdragon Auto, Snap… |
CVE-2019-11694 | High | 7.5 | 2019-07-23 | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an… |
CVE-2019-12815 | Critical | 9.8 | 2019-07-19 | An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a… |
CVE-2019-7846 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Informati… |
CVE-2019-5051 | High | 8.8 | 2019-07-03 | An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buff… |
CVE-2019-12449 | Medium | 5.7 | 2019-05-29 | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with… |
CVE-2019-10977 | High | 7.5 | 2019-05-23 | In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP se… |
CVE-2019-6807 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a… |
CVE-2018-7852 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7849 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a p… |
CVE-2019-1858 | High | 8.6 | 2019-05-16 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthen… |
CVE-2019-1731 | Medium | 4.4 | 2019-05-15 | A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH… |
CVE-2019-10917 | Medium | 5.5 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-10742 | High | 7.5 | 2019-05-07 | Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is… |
CVE-2019-3565 | High | 7.5 | 2019-05-06 | Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result… |
CVE-2019-3564 | High | 7.5 | 2019-05-06 | Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short m… |
CVE-2019-3559 | High | 7.5 | 2019-05-06 | Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short… |
CVE-2019-3558 | High | 7.5 | 2019-05-06 | Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send sho… |
CVE-2019-3552 | High | 7.5 | 2019-05-06 | C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients coul… |
CVE-2019-1635 | High | 7.5 | 2019-05-03 | A vulnerability in the call-handling functionality of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and 8800 Series could allow an… |
CVE-2019-6575 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All ver… |
CVE-2019-9628 | High | 7.5 | 2019-04-11 | The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invali… |
CVE-2019-7474 | Medium | 6.5 | 2019-04-02 | A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate wi… |
CVE-2019-9735 | Medium | 6.5 | 2019-03-13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By… |
CVE-2019-1691 | Medium | 5.8 | 2019-02-21 | A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected rest… |
CVE-2019-6256 | Critical | 9.8 | 2019-01-14 | A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in han… |
CVE-2018-1677 | Medium | 5.1 | 2018-12-20 | IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of… |
CVE-2018-19991 | Critical | 9.8 | 2018-12-10 | VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to… |
CVE-2018-11921 | High | 7.8 | 2018-11-28 | Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI behavior and create unintended SUI display… |
CVE-2017-2877 | Critical | 9.8 | 2018-09-19 | A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted r… |
CVE-2018-16781 | Medium | 6.5 | 2018-09-10 | ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progressive JPEG file that lacks an AC Huffman t… |
CVE-2017-7518 | Medium | 5.5 | 2018-07-30 | A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall in… |
CVE-2018-8039 | High | 8.1 | 2018-07-02 | It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.interna… |
CVE-2017-17172 | High | 7.3 | 2018-06-14 | Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. An authenticated, local attacker can craf… |
CVE-2018-0316 | High | 7.5 | 2018-06-07 | A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Fi… |
CVE-2018-1269 | Medium | 6.5 | 2018-06-06 | Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not ha… |
CVE-2018-0286 | Medium | 5.3 | 2018-05-02 | A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2017-9658 | Medium | 6.5 | 2018-04-30 | Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not required, which can nec… |
CVE-2017-9657 | Medium | 6.5 | 2018-04-30 | Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring statio… |
CVE-2018-0272 | Medium | 5.9 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial o… |
CVE-2018-0155 | High | 8.6 | 2018-03-28 | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series… |
CVE-2018-0934 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine… |
CVE-2017-14178 | High | 7.5 | 2018-02-02 | In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated… |
CVE-2017-13199 | High | 7.5 | 2018-01-12 | In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. This could lead to a remote deni… |
CVE-2017-17044 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishan… |
CVE-2017-0904 | High | 8.1 | 2017-11-13 | The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not… |
CVE-2017-0762 | High | 7.8 | 2017-09-08 | A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Androi… |
CVE-2017-0760 | High | 7.8 | 2017-09-08 | A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A… |
CVE-2017-0759 | High | 7.8 | 2017-09-08 | A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A… |
CVE-2017-11472 | High | 7.1 | 2017-07-20 | The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack du… |
CVE-2017-11140 | Medium | 5.5 | 2017-07-10 | The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attacker… |
CVE-2017-7496 | High | 7.0 | 2017-06-26 | fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation fai… |
CVE-2017-6678 | High | 7.5 | 2017-06-26 | A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 19.2 through 21.0 co… |
CVE-2017-0193 | High | 7.8 | 2017-06-15 | Windows Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-5664 | High | 7.5 | 2017-06-06 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the… |
CVE-2017-0622 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary code within the contex… |
CVE-2017-6628 | Medium | 6.8 | 2017-05-03 | A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated… |
CVE-2017-3887 | Medium | 5.9 | 2017-04-07 | A vulnerability in the detection engine that handles Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, rem… |
CVE-2017-3832 | High | 7.5 | 2017-04-06 | A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a deni… |
CVE-2017-5638 | Critical | 9.8 | 2017-03-11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation dur… |
CVE-2014-1943 | | 2014-02-18 | Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indir… | |
CVE-2006-5170 | | 2006-10-10 | pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP… |