Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,745)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-5534 1Flashtux 1Weechat Apr 29, 2026 Dec 3, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."
CVE-2012-4222 1Google 1Android Apr 29, 2026 Nov 30, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application tha...Show more drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application that uses crafted arguments in a local kgsl_ioctl call.Show less
CVE-2012-5136 2Google Opensuse 2Chrome Opensuse Apr 29, 2026 Nov 28, 2012 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown othe...Show more Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.Show less
CVE-2012-6044 1Mjsware 1M Player Apr 29, 2026 Nov 26, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.
CVE-2012-5520 1Openvas 1Openvas Manager Apr 29, 2026 Nov 26, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
CVE-2012-4538 1Xen 1Xen Apr 29, 2026 Nov 24, 2012 N/A· v4 N/A· v3 4.9 MEDIUM· v2 The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash...Show more The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.Show less
CVE-2012-2246 1Mahara 1Mahara Apr 29, 2026 Nov 24, 2012 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
CVE-2012-0960 1Ps Project Management Team 1Unity Firefox Extension Apr 29, 2026 Nov 24, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary...Show more Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request.Show less
CVE-2012-6035 1Xen 1Xen Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 6.9 MEDIUM· v2 The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host...Show more The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.Show less
CVE-2012-6034 1Xen 1Xen Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 4.4 MEDIUM· v2 The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output...Show more The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.Show less
CVE-2012-6031 1Xen 1Xen Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 4.7 MEDIUM· v2 The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being he...Show more The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.Show less
CVE-2012-6030 1Xen 1Xen Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 7.2 HIGH· v2 The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors...Show more The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.Show less
CVE-2012-3515 7Canonical DebianOpensuse+4 more 13Debian Linux Enterprise Linux DesktopEnterprise Linux Eus+10 more Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 7.2 HIGH· v2 Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers t...Show more Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."Show less
CVE-2012-3498 2Citrix Xen 2Xen Xenserver Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 5.6 MEDIUM· v2 PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory via vectors related to...Show more PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory via vectors related to a missing range check of map->index.Show less
CVE-2012-3497 1Xen 1Xen Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 6.9 MEDIUM· v2 (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a den...Show more (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.Show less
CVE-2012-3495 2Citrix Xen 2Xen Xenserver Apr 29, 2026 Nov 23, 2012 N/A· v4 N/A· v3 6.1 MEDIUM· v2 The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value i...Show more The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.Show less
CVE-2012-5703 1Vmware 2Esx Esxi Apr 29, 2026 Nov 20, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request.
CVE-2011-4612 1Xiph 1Icecast Apr 29, 2026 Nov 20, 2012 N/A· v4 N/A· v3 5.0 MEDIUM· v2 icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.
CVE-2012-4520 1Djangoproject 1Django Apr 29, 2026 Nov 18, 2012 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
CVE-2012-4945 1Agilefleet 2Fleetcommander Fleetcommander Kiosk Apr 29, 2026 Nov 18, 2012 N/A· v4 N/A· v3 7.5 HIGH· v2 Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue.

Previous 1...534535536...638 Next