Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,894)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-4034 1Macpaw 1Cleanmymac X Nov 21, 2024 Jan 10, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as r...Show more The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.Show less
CVE-2018-4033 1Macpaw 1Cleanmymac X Nov 21, 2024 Jan 10, 2019 N/A· v4 5.5 MEDIUM· v3 6.6 MEDIUM· v2 The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
CVE-2018-4032 1Macpaw 1Cleanmymac X Nov 21, 2024 Jan 10, 2019 N/A· v4 5.5 MEDIUM· v3 6.6 MEDIUM· v2 An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could use this vulnerability to modify the file system as root. An...Show more An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.Show less
CVE-2018-20683 1Gitolite 1Gitolite Nov 21, 2024 Jan 10, 2019 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.
CVE-2018-16196 1Yokogawa 9B/m9000 Vp Centum Cs 3000 Entry ClassCentum Cs 3000 Firmware+6 more Nov 21, 2024 Jan 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01...Show more Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors.Show less
CVE-2018-16185 1Ricoh 8D2200 Firmware D5500 FirmwareD5510 Firmware+5 more Nov 21, 2024 Jan 9, 2019 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400),...Show more RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute a malicious program.Show less
CVE-2018-6169 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page.
CVE-2018-6160 1Google 1Chrome Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2018-6140 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a craf...Show more Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.Show less
CVE-2018-6139 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted C...Show more Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.Show less
CVE-2018-6114 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2018-6113 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2018-6111 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page.
CVE-2018-6110 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page.
CVE-2018-6096 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
CVE-2018-6084 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more Jun 17, 2026 Jan 9, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.
CVE-2018-20070 1Google 1Chrome Nov 21, 2024 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVE-2018-20068 1Google 1Chrome Nov 21, 2024 Jan 9, 2019 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
CVE-2018-20065 1Google 1Chrome Nov 21, 2024 Jan 9, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file.
CVE-2018-16088 2Google Redhat 4Chrome Enterprise Linux DesktopEnterprise Linux Server+1 more Nov 21, 2024 Jan 9, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page.

Previous 1...330331332...645 Next