VYPR

CWE-20

Improper Input Validation

ClassStableLikelihood: High

Description

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-101 · CAPEC-104 · CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-136 · CAPEC-14 · CAPEC-153 · CAPEC-182 · CAPEC-209 · CAPEC-22 · CAPEC-23 · CAPEC-230 · CAPEC-231 · CAPEC-24 · CAPEC-250 · CAPEC-261 · CAPEC-267 · CAPEC-28 · CAPEC-3 · CAPEC-31 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-473 · CAPEC-52 · CAPEC-53 · CAPEC-588 · CAPEC-63 · CAPEC-64 · CAPEC-664 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-73 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-81 · CAPEC-83 · CAPEC-85 · CAPEC-88 · CAPEC-9

CVEs mapped to this weakness (8,003)

page 43 of 401
  • CVE-2017-3858HigMar 22, 2017
    Cisco Systems, Inc.
    iOS Xe
    risk 0.57cvss 8.8epss 0.03

    A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An…

  • CVE-2016-9726HigMar 7, 2017
    IBM
    Qradar Security Information And Event Manager
    risk 0.57cvss 8.8epss 0.02

    IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.

  • CVE-2016-9383HigJan 23, 2017
    Xen
    Xen
    risk 0.57cvss 8.8epss 0.01

    Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test…

  • CVE-2016-5197HigJan 19, 2017
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.

  • CVE-2016-6645HigOct 5, 2016
    Dell
    Emc Unisphere
    risk 0.57cvss 8.8epss 0.04

    The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via crafted input to the (1) GeneralCmdRequest, (2)…

  • CVE-2016-4972CriSep 26, 2016
    OpenStack
    Murano
    risk 0.57cvss 9.8epss 0.03

    OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when…

  • CVE-2016-4728HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2016-5272HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.02

    The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a…

  • CVE-2016-5879HigSep 2, 2016
    IBM
    Mq Appliance
    risk 0.57cvss 8.8epss 0.00

    MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.

  • CVE-2016-1365HigAug 18, 2016
    Cisco Systems, Inc.
    Application Policy Infrastructure Controller Enterprise Module
    risk 0.57cvss 8.8epss 0.03

    The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter, aka Bug ID CSCux15507.

  • CVE-2016-3301HigAug 9, 2016
    Microsoft
    Office
    risk 0.57cvss 7.8epss 0.44

    The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync…

  • CVE-2016-1430HigAug 8, 2016
    Cisco Systems, Inc.
    Rv180w
    risk 0.57cvss 8.8epss 0.04

    Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request, aka Bug ID CSCuz48592.

  • CVE-2016-1374HigJul 28, 2016
    Cisco Systems, Inc.
    Unified Computing System Performance Manager
    risk 0.57cvss 8.8epss 0.03

    The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827.

  • CVE-2016-1442HigJul 7, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.57cvss 8.8epss 0.03

    The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280.

  • CVE-2016-1408HigJul 2, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.57cvss 8.8epss 0.02

    Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request, aka Bug ID CSCuz01488.

  • CVE-2016-2141CriJun 30, 2016
    Red Hat
    JGroups
    risk 0.57cvss 9.8epss 0.05

    It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to…

  • CVE-2016-1391HigJun 4, 2016
    Cisco Systems, Inc.
    Prime Network Analysis Module Software
    risk 0.57cvss 8.8epss 0.02

    Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a…

  • CVE-2016-4782HigMay 23, 2016
    Lenovo
    Shareit
    risk 0.57cvss 8.8epss 0.02

    Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."

  • CVE-2016-1800HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.57cvss 8.8epss 0.04

    Captive Network Assistant in Apple OS X before 10.11.5 mishandles a custom URL scheme, which allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-1660HigMay 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted…