Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,815)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-4710 1Google 1Android Apr 29, 2026 Mar 3, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects...Show more Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.Show less
CVE-2012-6637 2Adobe Apache 2Cordova Phonegap Apr 29, 2026 Mar 3, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name t...Show more Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.Show less
CVE-2014-2097 1Ffmpeg 1Ffmpeg Apr 29, 2026 Mar 2, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array acce...Show more The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.Show less
CVE-2014-2039 1Linux 1Linux Kernel Apr 29, 2026 Feb 28, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by execut...Show more arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.Show less
CVE-2014-1874 3Canonical LinuxSuse 3Linux Enterprise Server Linux KernelUbuntu Linux Apr 29, 2026 Feb 28, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to s...Show more The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.Show less
CVE-2014-2103 1Cisco 1Intrusion Prevention System Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cisco Intrusion Prevention System (IPS) Software allows remote attackers to cause a denial of service (MainApp process outage) via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309.
CVE-2014-0679 1Cisco 1Prime Infrastructure Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 9.0 HIGH· v2 Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, a...Show more Cisco Prime Infrastructure 1.2 and 1.3 before 1.3.0.20-2, 1.4 before 1.4.0.45-2, and 2.0 before 2.0.0.0.294-2 allows remote authenticated users to execute arbitrary commands with root privileges via an unspecified URL, aka Bug ID CSCum71308.Show less
CVE-2014-1255 1Apple 1Mac Os X Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages.
CVE-2014-0747 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID...Show more The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.Show less
CVE-2014-0742 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 6.2 MEDIUM· v2 The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary fil...Show more The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.Show less
CVE-2011-2941 1Redhat 1Jboss Enterprise Portal Platform Apr 29, 2026 Feb 26, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the initialURI parameter.
CVE-2011-1749 1Linux Nfs 1Nfs Utils Apr 29, 2026 Feb 26, 2014 N/A· v4 N/A· v3 3.3 LOW· v2 The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows...Show more The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.Show less
CVE-2014-0033 1Apache 1Tomcat Apr 29, 2026 Feb 26, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct sess...Show more org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.Show less
CVE-2013-4322 1Apache 1Tomcat Apr 29, 2026 Feb 26, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP heade...Show more Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.Show less
CVE-2013-4286 1Apache 1Tomcat Apr 29, 2026 Feb 26, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers...Show more Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.Show less
CVE-2014-0758 1Iconics 1Genesis32 Apr 29, 2026 Feb 24, 2014 N/A· v4 N/A· v3 9.3 HIGH· v2 An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.
CVE-2013-6654 1Google 1Chrome Apr 29, 2026 Feb 24, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attack...Show more The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attackers to cause a denial of service (incorrect cast) or possibly have unspecified other impact via unknown vectors.Show less
CVE-2014-0819 1Autodesk 1Autocad Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 4.4 MEDIUM· v2 Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVE-2014-0730 1Cisco 1Unified Computing System Central Software Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cisco Unified Computing System (UCS) Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128.
CVE-2014-0720 1Cisco 1Ips Sensor Software Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 Cisco IPS Software 7.1 before 7.1(8)E4 and 7.2 before 7.2(2)E4 allows remote attackers to cause a denial of service (Analysis Engine process outage) via a flood of jumbo frames, aka Bug ID CSCuh94944.

Previous 1...507508509...641 Next