← Back
CWE-20

13,740 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,740)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-8010
1Cisco
1Unified Communications Domain Manager
May 6, 2026
Dec 10, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205.
CVE-2014-8003
1Cisco
1Unified Computing System
May 6, 2026
Dec 10, 2014
N/A· v4
N/A· v3
7.2 HIGH· v2
Cisco Integrated Management Controller in Cisco Unified Computing System 2.2(2c)A and earlier allows local users to obtain shell access via a crafted map-nfs command, aka Bug ID CSCup05998.
CVE-2014-4465
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Dec 10, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC...Show more
WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.Show less
CVE-2014-9351
1Teeworlds
1Teeworlds
May 6, 2026
Dec 9, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.
CVE-2014-9268
1Autodesk
1Design Review
May 6, 2026
Dec 8, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The AdView.AdViewer.1 ActiveX control in Autodesk Design Review (ADR) before 2013 Hotfix 1 allows remote attackers to execute arbitrary code via a crafted DWF file.
CVE-2014-9130
1Pyyaml
1Libyaml
May 6, 2026
Dec 8, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wr...Show more
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.Show less
CVE-2014-7251
1Yokogawa
1Fast/tools
May 6, 2026
Dec 6, 2014
N/A· v4
N/A· v3
3.2 LOW· v2
XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service (CPU or network traffic consumption) or read arbit...Show more
XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service (CPU or network traffic consumption) or read arbitrary files via unspecified vectors.Show less
CVE-2012-6656
3Canonical
DebianGnu
3Debian Linux
GlibcUbuntu Linux
May 6, 2026
Dec 5, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when conv...Show more
iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.Show less
CVE-2014-8789
1Gleamtech
1Filevista
May 6, 2026
Dec 2, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
GleamTech FileVista before 6.1 allows remote authenticated users to create arbitrary files and possibly execute arbitrary code via a crafted path in a zip archive, which is not properly handled during extraction.
CVE-2014-7178
1Enalean
1Tuleap
May 6, 2026
Nov 28, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
CVE-2014-9093
4Canonical
DebianFedoraproject+1 more
4Debian Linux
FedoraLibreoffice+1 more
May 6, 2026
Nov 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
CVE-2014-7142
3Canonical
OracleSquid Cache
3Solaris
SquidUbuntu Linux
May 6, 2026
Nov 26, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
CVE-2014-6609
1Digium
1Asterisk
May 6, 2026
Nov 26, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.
CVE-2014-2037
1Xelerance
1Openswan
May 6, 2026
Nov 26, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incompl...Show more
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.Show less
CVE-2014-9038
1Wordpress
1Wordpress
May 6, 2026
Nov 25, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 res...Show more
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.Show less
CVE-2014-8420
1Sonicwall
3Analyzer
Global Management SystemUma Em5000
May 6, 2026
Nov 25, 2014
N/A· v4
N/A· v3
9.0 HIGH· v2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary co...Show more
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.Show less
CVE-2014-7839
1Redhat
1Resteasy
May 6, 2026
Nov 25, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks vi...Show more
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.Show less
CVE-2014-9030
3Debian
OpensuseXen
3Debian Linux
OpensuseXen
May 6, 2026
Nov 24, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a craf...Show more
The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.Show less
CVE-2014-8416
1Digium
1Asterisk
May 6, 2026
Nov 24, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (cra...Show more
Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.Show less
CVE-2014-8415
1Digium
1Asterisk
May 6, 2026
Nov 24, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request fo...Show more
Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.Show less