← Back
CWE-20

13,740 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,740)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-0114
1Apache
2Commons Beanutils
Struts
Oct 14, 2026
Apr 30, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which...Show more
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.Show less
CVE-2013-7236
1Simplemachines
1Simple Machines Forum
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
CVE-2013-7235
1Simplemachines
1Simple Machines Forum
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters characters.
CVE-2013-7234
1Simplemachines
1Simple Machines Forum
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
CVE-2014-2184
1Cisco
1Unified Communications Manager
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352.
CVE-2014-2183
1Cisco
9Asr 1001
Asr 1002Asr 1002 X+6 more
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
6.3 MEDIUM· v2
The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973.
CVE-2014-2182
1Cisco
1Adaptive Security Appliance Software
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
6.1 MEDIUM· v2
Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520.
CVE-2014-2180
1Cisco
2Unified Contact Center Enterprise
Unified Contact Center Express Editor Software
May 6, 2026
Apr 29, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request,...Show more
The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133.Show less
CVE-2014-2986
1Xen
1Xen
May 6, 2026
Apr 28, 2014
N/A· v4
N/A· v3
5.5 MEDIUM· v2
The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL po...Show more
The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors.Show less
CVE-2014-2980
1Gnustep
1Base
May 6, 2026
Apr 28, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an...Show more
Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request.Show less
CVE-2014-0079
1Zarafa
1Zarafa
May 6, 2026
Apr 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors relat...Show more
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."Show less
CVE-2014-0037
1Zarafa
1Zarafa
May 6, 2026
Apr 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."
CVE-2014-2285
1Net Snmp
1Net Snmp
May 6, 2026
Apr 27, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an emp...Show more
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.Show less
CVE-2013-6053
1Uclouvain
1Openjpeg
May 6, 2026
Apr 27, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
CVE-2011-3603
1Litech
1Router Advertisement Daemon
May 6, 2026
Apr 27, 2014
N/A· v4
N/A· v3
4.4 MEDIUM· v2
The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact.
CVE-2014-0162
1Openstack
2Icehouse
Image Registry And Delivery Service (glance)
May 6, 2026
Apr 27, 2014
N/A· v4
N/A· v3
6.0 MEDIUM· v2
The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to exe...Show more
The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.Show less
CVE-2013-6887
1Uclouvain
1Openjpeg
May 6, 2026
Apr 27, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.
CVE-2014-1733
1Google
1Chrome
May 6, 2026
Apr 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote atta...Show more
The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.Show less
CVE-2013-4723
1Ddsn
1Cm3 Acora Content Management System
May 6, 2026
Apr 25, 2014
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing...Show more
Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx.Show less
CVE-2012-5723
1Cisco
9Asr 1001
Asr 1002Asr 1002 X+6 more
May 6, 2026
Apr 24, 2014
N/A· v4
N/A· v3
6.1 MEDIUM· v2
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentatio...Show more
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.Show less