CWE-20
13,782 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVEs (13,782)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento...Show more |
Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3....Show more |
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerabil...Show more |
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). |
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). |
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). |
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). |
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). |
ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for...Show more |
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). |