Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-0995 1Sap 1Netweaver May 6, 2026 Nov 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern.
CVE-2014-8544 2Canonical Ffmpeg 2Ffmpeg Ubuntu Linux May 6, 2026 Nov 5, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via c...Show more libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.Show less
CVE-2014-8543 2Canonical Ffmpeg 2Ffmpeg Ubuntu Linux May 6, 2026 Nov 5, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly...Show more libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.Show less
CVE-2014-3710 3Canonical DebianPhp 3Debian Linux PhpUbuntu Linux May 6, 2026 Nov 5, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service...Show more The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.Show less
CVE-2013-0336 1Redhat 1Freeipa May 6, 2026 Nov 3, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection...Show more The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.Show less
CVE-2014-0490 1Debian 1Advanced Package Tool May 6, 2026 Nov 3, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
CVE-2014-0489 1Debian 1Advanced Package Tool May 6, 2026 Nov 3, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
CVE-2014-0488 1Debian 1Advanced Package Tool May 6, 2026 Nov 3, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
CVE-2013-0334 3Bundler FedoraprojectOpensuse 3Bundler FedoraOpensuse May 6, 2026 Oct 31, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
CVE-2010-5077 3Ioquake3 OpenarenaTremulous 3Ioquake3 Engine OpenarenaTremulous May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstat...Show more server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.Show less
CVE-2014-3955 1Freebsd 1Freebsd May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP request from a source not on a directly connected network.
CVE-2014-0136 1Redhat 1Cloudforms 3.0 Management Engine May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
CVE-2011-4953 1Cobbler Project 1Cobbler May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load func...Show more The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.Show less
CVE-2011-4104 1Djangoproject 1Tastypie May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVE-2011-4103 1Djangoproject 1Piston May 6, 2026 Oct 27, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
CVE-2014-3137 1Bottlepy 1Bottle May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type follow...Show more Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.Show less
CVE-2014-0476 2Canonical Chkrootkit 2Chkrootkit Ubuntu Linux May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 3.7 LOW· v2 The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mo...Show more The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.Show less
CVE-2014-1929 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.4 MEDIUM· v2 python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomple...Show more python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less
CVE-2014-1928 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated usin...Show more The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less
CVE-2014-1927 1Python Gnupg Project 1Python Gnupg May 6, 2026 Oct 25, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$...Show more The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.Show less

Previous 1...535536537...687 Next