← Back
CWE-20

13,740 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,740)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-2855
1Samba
1Rsync
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
7.8 HIGH· v2
The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.
CVE-2014-2554
2Opensuse
Otrs
2Opensuse
Otrs
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.
CVE-2014-1318
1Apple
1Mac Os X
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
10.0 HIGH· v2
The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application.
CVE-2014-1316
1Apple
1Mac Os X
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.
CVE-2012-5427
1Cisco
1Ios
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Cisco IOS Unified Border Element (CUBE) in Cisco IOS before 15.3(2)T allows remote authenticated users to cause a denial of service (input queue wedge) via a crafted series of RTCP packets, aka Bug ID CSCuc42518.
CVE-2012-5017
1Cisco
8Asr 1001
Asr 1002Asr 1002 X+5 more
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cisco IOS before 15.1(1)SY1 allows remote authenticated users to cause a denial of service (device reload) by establishing a VPN session and then sending malformed IKEv2 packets, aka Bug ID CSCub39268.
CVE-2012-3062
1Cisco
1Ios
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
5.7 MEDIUM· v2
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains m...Show more
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.Show less
CVE-2012-1366
1Cisco
10Asr 1001
Asr 1002Asr 1002 X+7 more
May 6, 2026
Apr 23, 2014
N/A· v4
N/A· v3
6.1 MEDIUM· v2
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug...Show more
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.Show less
CVE-2014-2899
1Yassl
1Cyassl
May 6, 2026
Apr 22, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchang...Show more
wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found.Show less
CVE-2013-7338
2Apple
Python
2Mac Os X
Python
May 6, 2026
Apr 22, 2014
N/A· v4
N/A· v3
7.1 HIGH· v2
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(...Show more
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.Show less
CVE-2014-2735
1Winscp
1Winscp
May 6, 2026
Apr 22, 2014
N/A· v4
N/A· v3
5.8 MEDIUM· v2
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-m...Show more
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2014-2269
1Vtiger
1Vtiger Crm
May 6, 2026
Apr 22, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters.
CVE-2014-2922
1Pimcore
1Pimcore
May 6, 2026
Apr 21, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers...Show more
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.Show less
CVE-2014-2155
1Cisco
1Cns Network Registrar
May 6, 2026
Apr 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The DHCPv6 server module in Cisco CNS Network Registrar 7.1 allows remote attackers to cause a denial of service (daemon reload) via a malformed DHCPv6 packet, aka Bug ID CSCuo07437.
CVE-2014-2733
1Siemens
1Sinema Server
May 6, 2026
Apr 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80.
CVE-2014-2597
1Remote Rac
1Rac Server
May 6, 2026
Apr 18, 2014
N/A· v4
N/A· v3
4.9 MEDIUM· v2
PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-...Show more
PCNetSoftware RAC Server 4.0.4 and 4.0.5 allows local users to cause a denial of service (disabled keyboard or crash) via a large input buffer to unspecified IOCTL requests in RACDriver.sys, which triggers a buffer over-read.Show less
CVE-2014-2522
1Haxx
2Curl
Libcurl
May 6, 2026
Apr 18, 2014
N/A· v4
N/A· v3
4.0 MEDIUM· v2
curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNam...Show more
curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.Show less
CVE-2014-2289
1Digium
1Asterisk
May 6, 2026
Apr 18, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers...Show more
res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.Show less
CVE-2014-2288
1Digium
1Asterisk
May 6, 2026
Apr 18, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote a...Show more
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.Show less
CVE-2014-2287
2Digium
Fedoraproject
3Asterisk
Certified AsteriskFedora
May 6, 2026
Apr 18, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain...Show more
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.Show less