← Back
CWE-20

13,737 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (13,737)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-5643
1Squid Cache
1Squid
Apr 29, 2026
Dec 20, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1)...Show more
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.Show less
CVE-2012-5968
1Huawei
2E585
E585u 82
Apr 29, 2026
Dec 19, 2012
N/A· v4
N/A· v3
4.8 MEDIUM· v2
The Huawei E585 device does not validate the status of admin sessions, which allows remote attackers to obtain sensitive user information and the session ID, and modify data, by leveraging access to the LAN network.
CVE-2012-4348
1Symantec
1Endpoint Protection
Apr 29, 2026
Dec 18, 2012
N/A· v4
N/A· v3
7.2 HIGH· v2
The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP...Show more
The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors.Show less
CVE-2012-5610
1Owncloud
2Owncloud
Owncloud Server
Apr 29, 2026
Dec 18, 2012
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name.
CVE-2012-5513
1Xen
1Xen
Apr 29, 2026
Dec 13, 2012
N/A· v4
N/A· v3
6.9 MEDIUM· v2
The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecifie...Show more
The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range.Show less
CVE-2012-2549
1Microsoft
2Windows Server 2008
Windows Server 2012
Apr 29, 2026
Dec 12, 2012
N/A· v4
N/A· v3
5.8 MEDIUM· v2
The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restrictions via a revoked certificate, aka "Revok...Show more
The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restrictions via a revoked certificate, aka "Revoked Certificate Bypass Vulnerability."Show less
CVE-2012-6301
1Google
1Android
Apr 29, 2026
Dec 10, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.
CVE-2012-5688
2Canonical
Isc
2Bind
Ubuntu Linux
Apr 29, 2026
Dec 6, 2012
N/A· v4
N/A· v3
7.8 HIGH· v2
ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
CVE-2012-6062
1Wireshark
1Wireshark
Apr 29, 2026
Dec 5, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a craf...Show more
The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.Show less
CVE-2012-6059
1Wireshark
1Wireshark
Apr 29, 2026
Dec 5, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, wh...Show more
The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.Show less
CVE-2012-4982
1Forescout
1Counteract
Apr 29, 2026
Dec 5, 2012
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.
CVE-2012-4609
1Emc
1Rsa Netwitness Informer
Apr 29, 2026
Dec 5, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2012-5534
1Flashtux
1Weechat
Apr 29, 2026
Dec 3, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."
CVE-2012-4222
1Google
1Android
Apr 29, 2026
Nov 30, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application tha...Show more
drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application that uses crafted arguments in a local kgsl_ioctl call.Show less
CVE-2012-5136
2Google
Opensuse
2Chrome
Opensuse
Apr 29, 2026
Nov 28, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown othe...Show more
Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.Show less
CVE-2012-6044
1Mjsware
1M Player
Apr 29, 2026
Nov 26, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.
CVE-2012-5520
1Openvas
1Openvas Manager
Apr 29, 2026
Nov 26, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
CVE-2012-4538
1Xen
1Xen
Apr 29, 2026
Nov 24, 2012
N/A· v4
N/A· v3
4.9 MEDIUM· v2
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash...Show more
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.Show less
CVE-2012-2246
1Mahara
1Mahara
Apr 29, 2026
Nov 24, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
CVE-2012-0960
1Ps Project Management Team
1Unity Firefox Extension
Apr 29, 2026
Nov 24, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary...Show more
Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request.Show less