CWE-20
13,709 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CVEs (13,709)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and applic...Show more |
1Nitrosecurity 1Nitroview Esm Software Apr 29, 2026 Oct 27, 2010 N/A· v4 N/A· v3 6.8 MEDIUM· v2 ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess. |
1Tibco 4Activematrix Businessworks Service Engine Activematrix Service BusActivematrix Service Grid+1 moreApr 29, 2026 Oct 26, 2010 N/A· v4 N/A· v3 10.0 HIGH· v2 The (1) ActiveMatrix Runtime and (2) ActiveMatrix Administrator components in TIBCO ActiveMatrix Service Grid before 2.3.1, ActiveMatrix Service Bus before 2.3.1, ActiveMatrix BusinessWorks Service Engine before 5.8.1, a...Show more |
Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a cra...Show more |
The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships. |
Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property, which is not properly handled during navigation away from...Show more |
Opera before 10.63 allows user-assisted remote web servers to cause a denial of service (application crash) by sending a redirect during the saving of a file. |
Opera before 10.63 does not ensure that the portion of a URL shown in the Address Bar contains the beginning of the URL, which allows remote attackers to spoof URLs by changing a window's size. |
2Google Opensuse2Chrome OpensuseApr 29, 2026 Oct 21, 2010 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements." |
3Debian GoogleOpensuse3Chrome Debian LinuxOpensuseApr 29, 2026 Oct 21, 2010 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image. |
Google Chrome before 7.0.517.41 does not properly handle the unloading of a page, which allows remote attackers to spoof URLs via unspecified vectors. |
Google Chrome before 7.0.517.41 does not properly perform autofill operations for forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a craf...Show more |
Google Chrome before 7.0.517.41 does not properly handle forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document. |
bareFTP 0.3.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. |
The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed...Show more |
FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command. |
1Realnetworks 2Realplayer Realplayer SpApr 29, 2026 Oct 19, 2010 N/A· v4 N/A· v3 9.3 HIGH· v2 rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer, wh...Show more |
1Realnetworks 2Realplayer Realplayer SpApr 29, 2026 Oct 19, 2010 N/A· v4 N/A· v3 9.3 HIGH· v2 Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file, related to a "malfo...Show more |
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond...Show more |
1Microsoft 3Excel OfficeOpen Xml File Format ConverterApr 29, 2026 Oct 13, 2010 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel...Show more |