← Back
CWE-20

13,740 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,740)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-5014
1Ibm
1Cognos Disclosure Management
May 6, 2026
Oct 26, 2015
N/A· v4
N/A· v3
9.3 HIGH· v2
IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
CVE-2015-6987
1Apple
1Mac Os X
May 6, 2026
Oct 23, 2015
N/A· v4
N/A· v3
2.1 LOW· v2
The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted bookmark metadata in a folder.
CVE-2015-5945
1Apple
1Mac Os X
May 6, 2026
Oct 23, 2015
N/A· v4
N/A· v3
7.2 HIGH· v2
The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
CVE-2015-7004
1Apple
1Iphone Os
May 6, 2026
Oct 23, 2015
N/A· v4
N/A· v3
7.1 HIGH· v2
The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app.
CVE-2015-7750
1Juniper
1Screenos
May 6, 2026
Oct 19, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cau...Show more
The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cause a denial of service via a crafted L2TP packet.Show less
CVE-2015-7749
1Juniper
1Junos
May 6, 2026
Oct 19, 2015
N/A· v4
N/A· v3
7.8 HIGH· v2
The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."
CVE-2015-7748
1Juniper
1Junos
May 6, 2026
Oct 19, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card cr...Show more
Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.Show less
CVE-2015-1808
2Jenkins
Redhat
2Jenkins
Openshift
May 6, 2026
Oct 16, 2015
N/A· v4
N/A· v3
3.5 LOW· v2
Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
CVE-2015-6334
1Cisco
1Asr 5000 Software
May 6, 2026
Oct 16, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet, aka Bug ID CSCuw01984.
CVE-2015-7838
1Solarwinds
1Storage Manager
May 6, 2026
Oct 15, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
CVE-2015-6318
1Cisco
1Telepresence Video Communication Server Software
May 6, 2026
Oct 12, 2015
N/A· v4
N/A· v3
6.9 MEDIUM· v2
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 and X8.5.2 allows local users to write to arbitrary files via an unspecified symlink attack, aka Bug ID CSCuv11969.
CVE-2015-1047
1Vmware
1Vcenter Server
May 6, 2026
Oct 12, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
CVE-2015-1303
1Google
1Chrome
May 6, 2026
Oct 12, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass...Show more
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.Show less
CVE-2015-5235
3Fedoraproject
OpensuseRedhat
7Enterprise Linux Desktop
Enterprise Linux Hpc NodeEnterprise Linux Server+4 more
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via...Show more
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.Show less
CVE-2015-5234
3Fedoraproject
OpensuseRedhat
7Enterprise Linux Desktop
Enterprise Linux Hpc NodeEnterprise Linux Server+4 more
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
6.8 MEDIUM· v2
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute...Show more
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.Show less
CVE-2015-1337
2Canonical
Simpestreams Project
2Simplestreams
Ubuntu Linux
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response...Show more
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.Show less
CVE-2015-5883
1Apple
1Mac Os X
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the conten...Show more
The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override formatting characters differently, which allows remote attackers to spoof the content of a text document via a crafted character sequence.Show less
CVE-2015-5828
2Apple
Opensuse
2Leap
Safari
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restricti...Show more
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.Show less
CVE-2015-5780
1Apple
1Safari
May 6, 2026
Oct 9, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.
CVE-2015-6598
1Google
1Android
May 6, 2026
Oct 6, 2015
N/A· v4
N/A· v3
10.0 HIGH· v2
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.