← Back
CWE-20

12,815 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,815)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2013-2788
1Subnet
1Substation Server
Apr 29, 2026
Sep 17, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The DNP3 Slave service in SUBNET Solutions SubSTATION Server 2.7.0033 and 2.8.0106 allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.
CVE-2013-5650
1Juniper
2Junos Pulse Access Control Service
Junos Pulse Secure Access Service
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
5.4 MEDIUM· v2
Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and...Show more
Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote attackers to cause a denial of service (device hang) via a crafted packet.Show less
CVE-2013-4180
2Redhat
Theforeman
2Foreman
Openstack
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.
CVE-2013-4123
2Opensuse
Squid Cache
2Opensuse
Squid
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.
CVE-2013-1441
1Exactcode
1Exactimage
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.
CVE-2012-6087
1Moodle
1Moodle
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
5.8 MEDIUM· v2
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Commo...Show more
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.Show less
CVE-2013-5496
1Cisco
1Nx Os
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
6.3 MEDIUM· v2
Open Network Environment Platform (ONEP) in Cisco NX-OS allows remote authenticated users to cause a denial of service (network-element reload) via a crafted packet, aka Bug ID CSCui51551.
CVE-2013-1029
1Apple
1Mac Os X
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The kernel in Apple Mac OS X before 10.8.5 allows remote attackers to cause a denial of service (panic) via crafted IGMP packets that leverage incorrect, extraneous code in the IGMP parser.
CVE-2013-1028
1Apple
2Iphone Os
Mac Os X
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
5.8 MEDIUM· v2
The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateways, which allows man-in-the-middle attackers to spoof security gateways and obtai...Show more
The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateways, which allows man-in-the-middle attackers to spoof security gateways and obtain sensitive information via a crafted certificate.Show less
CVE-2013-5721
1Wireshark
1Wireshark
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attack...Show more
The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.Show less
CVE-2013-5717
1Wireshark
1Wireshark
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Bluetooth HCI ACL dissector in Wireshark 1.10.x before 1.10.2 does not properly maintain a certain free list, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that i...Show more
The Bluetooth HCI ACL dissector in Wireshark 1.10.x before 1.10.2 does not properly maintain a certain free list, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that is not properly handled by the wmem_block_alloc function in epan/wmem/wmem_allocator_block.c.Show less
CVE-2013-4812
1Hp
2Identity Driven Manager
Procurve Manager
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows...Show more
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.Show less
CVE-2013-4811
1Hp
2Identity Driven Manager
Procurve Manager
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allo...Show more
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.Show less
CVE-2013-2898
1Linux
1Linux Kernel
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
1.9 LOW· v2
drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information fr...Show more
drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.Show less
CVE-2013-2897
1Linux
1Linux Kernel
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
4.7 MEDIUM· v2
Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to c...Show more
Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device.Show less
CVE-2013-2888
1Linux
1Linux Kernel
Apr 29, 2026
Sep 16, 2013
N/A· v4
N/A· v3
6.2 MEDIUM· v2
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of ser...Show more
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.Show less
CVE-2013-5493
1Cisco
2Virtualization Experience Client 6000
Virtualization Experience Client 6000 Series Firmware
Apr 29, 2026
Sep 13, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The diagnostic module in the firmware on Cisco Virtualization Experience Client 6000 devices allows local users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors, aka Bug ID CS...Show more
The diagnostic module in the firmware on Cisco Virtualization Experience Client 6000 devices allows local users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors, aka Bug ID CSCug68407.Show less
CVE-2013-5738
1Wordpress
1Wordpress
Apr 29, 2026
Sep 12, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authen...Show more
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.Show less
CVE-2013-4339
1Wordpress
1Wordpress
Apr 29, 2026
Sep 12, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
CVE-2013-5488
1Cisco
4Prime Lan Management Solution
Security ManagerUnified Operations Manager+1 more
Apr 29, 2026
Sep 12, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ compo...Show more
Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ component, which allows remote attackers to cause a denial of service (memory consumption) via simultaneous TCP sessions, aka Bug IDs CSCuh54766, CSCuh01267, CSCuh95976, and CSCuh95969.Show less