CWE-20

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validat

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extra

A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to pr

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up t

A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wi

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes t

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transactio

Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00,

A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.

A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local atta

SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE

The TripAdvisor app with the versions before TAMobileApp-24.6.4 pre-installed in some Huawei mobile phones have an arbit

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earl

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.

In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer

The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote at

A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0

A denial of service vulnerability in the Android framework (package installer). Product: Android. Versions: 6.0, 6.0.1,

Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG

SCCPX module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE

A vulnerability in Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network based attacker to cause the m

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validat

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside fil

A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and down

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as

Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00;

SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 tha

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client c

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allo

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadin

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attac

Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the add

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will ha

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security che

A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake ad

Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of a

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The r

The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or

Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-

SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerabili

Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-doma

If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rend

Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When use

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Cust

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name t