CWE-20
12,891 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVEs (12,891)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This all...Show more |
1Huawei 9Eva Al10 Firmware Eva Cl00 FirmwareEva Dl00 Firmware+6 moreNov 21, 2024 Mar 5, 2018 N/A· v4 3.3 LOW· v3 4.3 MEDIUM· v2 Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-L09C576B150; EVA-L09C635B221; EVA-L09C636B193; EVA-L09C675B13...Show more |
1Huawei 24Dp300 Firmware Ips Module FirmwareNgfw Module Firmware+21 moreNov 21, 2024 Mar 5, 2018 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R...Show more |
1Aws Lambda Multipart Parser Project 1Aws Lambda Multipart Parser Jun 17, 2026 Mar 4, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string. |
Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. |
SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command. |
NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potential...Show more |
3Canonical PostgresqlRedhat3Cloudforms PostgresqlUbuntu LinuxNov 21, 2024 Mar 2, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the databa...Show more |
Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could be remotely exploited to allow Denial of Service. |
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit...Show more |
In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database. |
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content. |
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system. |
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system. |
2Opensuse Suse2Leap Linux Enterprise Software Development KitNov 21, 2024 Mar 1, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots. |
1F5 1Big Ip Application Security Manager Nov 21, 2024 Mar 1, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU...Show more |
1F5 10Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+7 moreNov 21, 2024 Mar 1, 2018 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Tra...Show more |
3Canonical RedhatZsh5Enterprise Linux Desktop Enterprise Linux ServerEnterprise Linux Workstation+2 moreJun 17, 2026 Feb 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. |
When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updat...Show more |
2Apache Debian2Debian Linux Traffic ServerNov 21, 2024 Feb 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump. |