Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-8607 3Canonical DebianPerl 3Debian Linux PathtoolsUbuntu Linux May 6, 2026 Jan 13, 2016 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protect...Show more The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.Show less
CVE-2015-8466 2Fedoraproject Openstack 2Fedora Swift3 May 6, 2026 Jan 13, 2016 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
CVE-2016-0005 1Microsoft 1Internet Explorer May 6, 2026 Jan 13, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVE-2015-7759 1F5 8Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+5 more May 6, 2026 Jan 12, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a deni...Show more BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets, related to Path MTU (PMTU) discovery.Show less
CVE-2015-8331 1Huawei 1Vcn500 May 6, 2026 Jan 11, 2016 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay...Show more The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay attacks via the session ID.Show less
CVE-2015-8760 1Typo3 1Typo3 May 6, 2026 Jan 8, 2016 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
CVE-2015-8226 1Huawei 2Ale Firmware Gem 703l Firmware May 6, 2026 Jan 8, 2016 N/A· v4 5.5 MEDIUM· v3 7.1 HIGH· v2 The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows r...Show more The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.Show less
CVE-2015-8225 1Huawei 2Ale Firmware Gem 703l Firmware May 6, 2026 Jan 8, 2016 N/A· v4 5.5 MEDIUM· v3 7.1 HIGH· v2 The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows r...Show more The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226.Show less
CVE-2015-7754 1Juniper 1Screenos May 6, 2026 Jan 8, 2016 N/A· v4 8.1 HIGH· v3 9.3 HIGH· v2 Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.
CVE-2015-7519 1Phusionpassenger 1Phusion Passenger May 6, 2026 Jan 8, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof hea...Show more agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.Show less
CVE-2015-5254 3Apache FedoraprojectRedhat 3Activemq FedoraOpenshift May 6, 2026 Jan 8, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMess...Show more Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.Show less
CVE-2015-8742 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service...Show more The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.Show less
CVE-2015-8741 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service...Show more The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.Show less
CVE-2015-8740 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of...Show more The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.Show less
CVE-2015-8739 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of servic...Show more The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.Show less
CVE-2015-8738 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote at...Show more The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.Show less
CVE-2015-8737 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service (divide-by-zero error and applic...Show more The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.Show less
CVE-2015-8736 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not reserve memory for a trailer, which allows remote attackers to cause a denial of service (stack-based buf...Show more The mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not reserve memory for a trailer, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.Show less
CVE-2015-8735 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a den...Show more The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.Show less
CVE-2015-8734 1Wireshark 1Wireshark May 6, 2026 Jan 4, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via...Show more The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.Show less

Previous 1...510511512...687 Next