Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,815)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-1051 2Canonical Debian 3Advanced Package Tool AptUbuntu Linux Apr 29, 2026 Mar 21, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity...Show more apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.Show less
CVE-2013-0670 1Siemens 1Wincc Tia Portal Apr 29, 2026 Mar 21, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVE-2013-0669 1Siemens 1Wincc Tia Portal Apr 29, 2026 Mar 21, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
CVE-2013-0716 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.
CVE-2013-0715 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.
CVE-2013-0714 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 10.0 HIGH· v2 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.
CVE-2013-0713 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 6.8 MEDIUM· v2 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.
CVE-2013-0712 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 6.8 MEDIUM· v2 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.
CVE-2013-0711 1Windriver 1Vxworks Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 7.8 HIGH· v2 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.
CVE-2013-1655 2Puppet Puppetlabs 3Puppet PuppetPuppet Enterprise Apr 29, 2026 Mar 20, 2013 N/A· v4 N/A· v3 7.5 HIGH· v2 Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
CVE-2013-1856 1Rubyonrails 2Rails Ruby On Rails Apr 29, 2026 Mar 19, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly...Show more The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.Show less
CVE-2013-1854 2Redhat Rubyonrails 3Enterprise Linux RailsRuby On Rails Apr 29, 2026 Mar 19, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial...Show more The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.Show less
CVE-2013-0505 1Ibm 2Sterling Multi Channel Fulfillment Solution Sterling Selling And Fulfillment Foundation Apr 29, 2026 Mar 19, 2013 N/A· v4 N/A· v3 5.5 MEDIUM· v2 IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML file...Show more IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.Show less
CVE-2013-0331 1Jenkins 1Jenkins Apr 29, 2026 Mar 19, 2013 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
CVE-2012-4462 2Condor Project Redhat 2Condor Enterprise Mrg Apr 29, 2026 Mar 14, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.
CVE-2013-0252 1Boost 1Boost Apr 29, 2026 Mar 12, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mec...Show more boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.Show less
CVE-2013-2503 1Privoxy 1Privoxy Apr 29, 2026 Mar 11, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a...Show more Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.Show less
CVE-2013-0308 1Git Scm 1Git Apr 29, 2026 Mar 8, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middl...Show more The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2013-1656 1Spreecommerce 1Spree Apr 29, 2026 Mar 8, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/...Show more Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.Show less
CVE-2013-2488 3Debian OpensuseWireshark 3Debian Linux OpensuseWireshark Apr 29, 2026 Mar 7, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (a...Show more The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.Show less

Previous 1...532533534...641 Next