← Back
CWE-20

13,740 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,740)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-6611
1Blackberry
2Blackberry Os
Blackberry World
May 6, 2026
Oct 25, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which...Show more
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.Show less
CVE-2014-6151
1Ibm
1Tivoli Integrated Portal
May 6, 2026
Oct 25, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2014-6230
1Wp Ban Project
1Wp Ban
May 6, 2026
Oct 25, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.
CVE-2014-4840
1Ibm
1Tririga Application Platform
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.
CVE-2014-4833
1Ibm
1Qradar Security Information And Event Manager
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote authenticated users to gain privileges via invalid input.
CVE-2014-4828
1Ibm
1Qradar Security Information And Event Manager
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote attackers to conduct clickjacking attacks via a crafted HTTP request.
CVE-2014-3567
1Openssl
1Openssl
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted s...Show more
Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.Show less
CVE-2014-3513
1Openssl
1Openssl
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.
CVE-2014-3021
1Ibm
1Websphere Application Server
May 6, 2026
Oct 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication d...Show more
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method.Show less
CVE-2014-4443
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
7.8 HIGH· v2
Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data.
CVE-2014-4442
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
4.7 MEDIUM· v2
The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system control socket.
CVE-2014-4434
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem.
CVE-2014-4417
1Apple
1Mac Os X
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafte...Show more
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.Show less
CVE-2014-3573
1Redhat
1Enterprise Virtualization Manager
May 6, 2026
Oct 18, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other...Show more
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.Show less
CVE-2014-2278
1Seeddms
1Seeddms
May 6, 2026
Oct 17, 2014
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specifi...Show more
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it via the directory specified by the fileId parameter.Show less
CVE-2014-8755
1Panasonic
1Network Camera View
May 6, 2026
Oct 17, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory...Show more
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory."Show less
CVE-2014-8310
1Sap
1Businessobjects
May 6, 2026
Oct 16, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-3686
3Canonical
DebianW1.fi
4Debian Linux
HostapdUbuntu Linux+1 more
May 6, 2026
Oct 16, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.
CVE-2014-4138
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a differe...Show more
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4130 and CVE-2014-4132.Show less
CVE-2014-4134
1Microsoft
1Internet Explorer
May 6, 2026
Oct 15, 2014
N/A· v4
N/A· v3
9.3 HIGH· v2
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."