Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,703)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-2861 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Google Chrome before 14.0.835.163 does not properly handle strings in PDF documents, which allows remote attackers to have an unspecified impact via a crafted document that triggers an incorrect read operation.
CVE-2011-2848 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Google Chrome before 14.0.835.163 allows user-assisted remote attackers to spoof the URL bar via vectors related to the forward button.
CVE-2011-2842 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The installer in Google Chrome before 14.0.835.163 on Mac OS X does not properly handle lock files, which has unspecified impact and attack vectors.
CVE-2011-2841 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact...Show more Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.Show less
CVE-2011-2840 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Google Chrome before 14.0.835.163 allows user-assisted remote attackers to spoof the URL bar via vectors related to "unusual user interaction."
CVE-2011-2838 1Google 1Chrome Apr 29, 2026 Sep 19, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Google Chrome before 14.0.835.163 does not properly consider the MIME type during the loading of a plug-in, which has unspecified impact and remote attack vectors.
CVE-2011-3496 1Measuresoft 1Scadapro Apr 29, 2026 Sep 16, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) BF, (2) OF, or (3) EF command.
CVE-2011-3211 1Bcfg2 1Bcfg2 Apr 29, 2026 Sep 16, 2011 N/A· v4 N/A· v3 9.3 HIGH· v2 The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.
CVE-2011-2442 1Adobe 2Acrobat Acrobat Reader Apr 29, 2026 Sep 15, 2011 N/A· v4 N/A· v3 9.3 HIGH· v2 Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error vulnerability."
CVE-2011-1989 1Microsoft 7Excel Excel ViewerExcel Web App+4 more Apr 29, 2026 Sep 15, 2011 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2;...Show more Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; Excel Services on Office SharePoint Server 2007 SP2; Excel Services on Office SharePoint Server 2010 Gold and SP1; and Excel Web App 2010 Gold and SP1 do not properly parse conditional expressions associated with formatting requirements, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Conditional Expression Parsing Vulnerability."Show less
CVE-2011-1982 1Microsoft 1Office Apr 29, 2026 Sep 15, 2011 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, ak...Show more Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Office Uninitialized Object Pointer Vulnerability."Show less
CVE-2011-3422 1Apple 2Mac Os X Mac Os X Server Apr 29, 2026 Sep 12, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof ar...Show more The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.Show less
CVE-2011-2724 1Samba 1Samba Apr 29, 2026 Sep 6, 2011 N/A· v4 N/A· v3 1.2 LOW· v2 The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allow...Show more The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.Show less
CVE-2011-2660 1Suse 2Linux Enterprise Desktop Vpnc Apr 29, 2026 Sep 6, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.
CVE-2011-2723 1Linux 1Linux Kernel Apr 29, 2026 Sep 6, 2011 N/A· v4 N/A· v3 5.7 MEDIUM· v2 The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attacke...Show more The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.Show less
CVE-2011-2654 1Novell 1Cloud Manager Apr 29, 2026 Sep 6, 2011 N/A· v4 N/A· v3 9.3 HIGH· v2 The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect...Show more The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session.Show less
CVE-2011-3387 1Ibm 1Java Apr 29, 2026 Sep 2, 2011 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to va...Show more The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.Show less
CVE-2011-2763 1Lifesize 1Lifesize Room Appliance Software Apr 29, 2026 Sep 2, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php.
CVE-2011-2899 1Redhat 1System Config Printer Apr 29, 2026 Aug 31, 2011 N/A· v4 N/A· v3 5.1 MEDIUM· v2 pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup...Show more pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name, which are not properly handled when searching for network printers.Show less
CVE-2011-0228 1Apple 1Iphone Os Apr 29, 2026 Aug 29, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof...Show more The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.Show less

Previous 1...602603604...686 Next