Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-1303 1Cisco 1500 Series Switch Firmware May 6, 2026 Jan 30, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330.
CVE-2016-0756 1Prosody 1Prosody May 6, 2026 Jan 29, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafte...Show more The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.Show less
CVE-2016-0754 1Haxx 1Curl May 6, 2026 Jan 29, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.
CVE-2016-1983 1Privoxy 1Privoxy May 6, 2026 Jan 27, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP Host header.
CVE-2016-1982 1Privoxy 1Privoxy May 6, 2026 Jan 27, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via crafted chunk-encoded content.
CVE-2016-1612 1Google 1Chrome May 6, 2026 Jan 25, 2016 N/A· v4 7.6 HIGH· v3 6.8 MEDIUM· v2 The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote at...Show more The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.Show less
CVE-2016-1570 1Xen 1Xen May 6, 2026 Jan 22, 2016 N/A· v4 8.5 HIGH· v3 6.9 MEDIUM· v2 The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other i...Show more The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.Show less
CVE-2016-1929 1Sap 1Hana May 6, 2026 Jan 20, 2016 N/A· v4 9.3 CRITICAL· v3 8.5 HIGH· v2 The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request, related to an unspecified...Show more The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request, related to an unspecified debug function, aka SAP Security Note 2241978.Show less
CVE-2015-8705 1Isc 1Bind May 6, 2026 Jan 20, 2016 N/A· v4 7.0 HIGH· v3 6.6 MEDIUM· v2 buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have uns...Show more buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.Show less
CVE-2015-8704 1Isc 1Bind May 6, 2026 Jan 20, 2016 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (...Show more apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.Show less
CVE-2015-4951 1Ibm 1Tivoli Storage Manager May 6, 2026 Jan 20, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of servi...Show more Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.Show less
CVE-2015-6864 1Hp 1Arcsight Logger May 6, 2026 Jan 16, 2016 N/A· v4 6.3 MEDIUM· v3 6.5 MEDIUM· v2 HPE ArcSight Logger before 6.1P1 allows remote authenticated users to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
CVE-2015-6863 1Hp 1Arcsight Logger May 6, 2026 Jan 16, 2016 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.
CVE-2016-1262 1Juniper 1Junos May 6, 2026 Jan 15, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG...Show more Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled, allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet.Show less
CVE-2016-1258 1Juniper 1Junos May 6, 2026 Jan 15, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before...Show more Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors.Show less
CVE-2016-1257 1Juniper 1Junos May 6, 2026 Jan 15, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 before 14.1R3-S9, 14.1R4 before 14.1R4-S7, 14.1X51 before 14.1X51-D65, 14.1X53 bef...Show more The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 before 14.1R3-S9, 14.1R4 before 14.1R4-S7, 14.1X51 before 14.1X51-D65, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D28, 14.1X53 before 4.1X53-D35, 14.2R1 before 14.2R5, 14.2R3 before 14.2R3-S4, 14.2R4 before 14.2R4-S1, 15.1 before 15.1R3, 15.1F2 before 15.1F2-S2, and 15.1X49 before 15.1X49-D40, when LDP is enabled, allows remote attackers to cause a denial of service (RPD routing process crash) via a crafted LDP packet.Show less
CVE-2015-8688 1Gajim 1Gajim May 6, 2026 Jan 15, 2016 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.
CVE-2015-8605 4Canonical DebianIsc+1 more 4Debian Linux DhcpUbuntu Linux+1 more May 6, 2026 Jan 14, 2016 N/A· v4 6.5 MEDIUM· v3 5.7 MEDIUM· v2 ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
CVE-2016-1569 1Firebirdsql 1Firebird May 6, 2026 Jan 13, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.
CVE-2016-1494 3Fedoraproject OpensusePython 4Fedora LeapOpensuse+1 more May 6, 2026 Jan 13, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

Previous 1...509510511...687 Next