CWE-20 <span class="text-2xl md:text-3xl font-bold ml-2" style="color:var(--text-secondary)">— Improper Input Validation

CVE-2017-12531HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12532HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12533HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12534HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12535HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12536HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12537HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12538HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12539HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12540HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12541HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12554HIGHCVSS 8.8EG 8.8

A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.

CVE-2017-12632HIGHCVSS 7.5EG 7.5

A remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT iMC Plat 7.3 E0504P2 and earlier was found.

2018-01-23

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users runn…

CVE-2017-12652CRITICALCVSS 9.8EG 9.8

2019-07-10

libpng before 1.6.32 does not properly check the length of chunks against the user limit.

CVE-2017-12701MEDIUMCVSS 6.5EG 6.5

2018-04-17

BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authenticated attacker to crash the CPAP's Wi-Fi module resulting in a denial-of-service condition.

CVE-2017-12795CRITICALCVSS 9.8EG 9.8

2019-05-10

OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).

CVE-2017-12842HIGHCVSS 7.5EG 7.5

2020-03-16

Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars…

CVE-2017-13176HIGHCVSS 8.8EG 8.8

CVE-2017-13186HIGHCVSS 7.5EG 7.5

In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a remote elevation of privilege that could enable bypassing user interaction requirements with no additional execution p…

CVE-2017-13194HIGHCVSS 7.5EG 7.5

A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65735716.

CVE-2017-13198HIGHCVSS 7.5EG 7.5

A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.

CVE-2017-13214HIGHCVSS 7.5EG 7.5

A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68399117.

CVE-2017-13229CRITICALCVSS 9.8EG 9.8

In the hardware HEVC decoder, some media files could cause a page fault. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploita…

2018-02-12

A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68160703.

CVE-2017-13284CRITICALCVSS 9.8EG 9.8

CVE-2017-13287HIGHCVSS 7.8EG 7.8

In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User i…

CVE-2017-13295MEDIUMCVSS 5.3EG 5.3

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional exe…

CVE-2017-13300HIGHCVSS 7.5EG 7.5

A denial of service vulnerability in the Android framework (package installer). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-62537081.

CVE-2017-13301HIGHCVSS 7.5EG 7.5

A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 6.0, 6.0.1. Android ID: A-71567394.

CVE-2017-13302HIGHCVSS 7.5EG 7.5

A denial of service vulnerability in the Android system (system ui). Product: Android. Versions: 8.0. Android ID: A-66498711.

CVE-2017-13652MEDIUMCVSS 6.5EG 6.5

A denial of service vulnerability in the Android system (system ui). Product: Android. Versions: 8.0. Android ID: A-69969749.

2018-07-31

NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended action in the user interface.

CVE-2017-13890HIGHCVSS 7.4EG 7.4

2018-04-03

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. macOS before 10.13 is affected. The issue involves the "CoreTypes" component. It allows remote attackers to trigger disk-image mounting via a crafted web …

CVE-2017-13891MEDIUMCVSS 6.5EG 6.5

2019-01-11

In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.

CVE-2017-13911HIGHCVSS 7.8EG 7.8

2019-04-03

A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS X El Capitan 10.11.6 Security Update 2018-002, macOS Sierra 10.12.6 Security Update 2018-002, macOS High Sierra 10.13.2.

CVE-2017-14438HIGHCVSS 7.5EG 7.5

2018-05-14

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp to trigg…

CVE-2017-14439HIGHCVSS 7.5EG 7.5

2018-05-14

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4001/tcp to trigg…

CVE-2017-14804CRITICALCVSS 9.9EG 5.3

2018-03-01

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.

CVE-2017-14878HIGHCVSS 7.5EG 7.5

2018-03-15

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a length variable which is used to copy data has a size of only 8 bits and can be exceeded resulting in a denial of service.

CVE-2017-14892HIGHCVSS 7.8EG 7.8

2018-03-30

In the function msm_pcm_hw_params() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asm_open_shared_io() is not checked properly potentially leading to a possible dangling pointer access.

CVE-2017-14913CRITICALCVSS 9.8EG 9.8

2018-03-30

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input validation is being improperly truncated.

CVE-2017-15043HIGHCVSS 8.8EG 8.8

2018-05-04

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to ex…

CVE-2017-15093MEDIUMCVSS 5.3EG 5.3

2018-01-23

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by addin…

CVE-2017-15105MEDIUMCVSS 5.3EG 5.3

2018-01-23

A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick …

CVE-2017-15124HIGHCVSS 7.5EG 7.5

2018-01-09

VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these …

CVE-2017-15136LOWCVSS 2.7EG 2.7

2018-02-27

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including securi…

CVE-2017-15137MEDIUMCVSS 4.3EG 5.3

2018-07-16

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

CVE-2017-1516MEDIUMCVSS 5.4EG 5.4

2018-01-26

IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's cli…

CVE-2017-15333MEDIUMCVSS 4.7EG 4.7

CVE-2017-15346MEDIUMCVSS 4.7EG 4.7

XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6…