CWE-20
12,929 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVEs (12,929)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). |
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). |
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). |
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). |
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). |
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). |
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). |
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento...Show more |
Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3....Show more |
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerabil...Show more |
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |