Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-43548 1Philips 1Patient Information Center Ix Jun 17, 2026 Dec 27, 2021 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
CVE-2021-45711 1Simple Asn1 Project 1Simple Asn1 Jun 17, 2026 Dec 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
CVE-2021-45687 1Raw Cpuid Project 1Raw Cpuid Jun 17, 2026 Dec 27, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption...Show more An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.Show less
CVE-2021-41788 1Mediatek 8Mt7603e Firmware Mt7612 FirmwareMt7613 Firmware+5 more Jun 17, 2026 Dec 26, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and other devices, mishandle attempts at Wi-Fi authentication flooding. (Affected Chipsets MT7603E, MT7612, MT7613, MT7615, MT7622, MT7628, MT7629, MT791...Show more MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and other devices, mishandle attempts at Wi-Fi authentication flooding. (Affected Chipsets MT7603E, MT7612, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 7.4.0.0).Show less
CVE-2021-44548 1Apache 1Solr Jun 17, 2026 Dec 23, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the networ...Show more An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.Show less
CVE-2021-4059 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2021-38015 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Dec 23, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVE-2021-44422 1Opendesign 1Drawings Sdk Jun 17, 2026 Dec 21, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file can trigger a write operation past the end of an allocated buff...Show more An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. Crafted data in a BMP file can trigger a write operation past the end of an allocated buffer, or lead to a heap-based buffer overflow. An attacker can leverage this vulnerability to execute code in the context of the current process.Show less
CVE-2021-41561 1Apache 1Parquet Java Jun 17, 2026 Dec 20, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.
CVE-2021-45105 5Apache DebianNetapp+2 more 1176bk1602 0aa12 0tp0 Firmware 6bk1602 0aa22 0tp0 Firmware6bk1602 0aa32 0tp0 Firmware+114 more Aug 25, 2026 Dec 18, 2021 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data t...Show more Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.Show less
CVE-2021-37863 1Mattermost 1Mattermost Server Jun 17, 2026 Dec 17, 2021 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
CVE-2021-1021 1Google 1Android Jun 17, 2026 Dec 15, 2021 N/A· v4 7.3 HIGH· v3 4.4 MEDIUM· v2 In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with U...Show more In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031703Show less
CVE-2021-1020 1Google 1Android Jun 17, 2026 Dec 15, 2021 N/A· v4 7.3 HIGH· v3 4.4 MEDIUM· v2 In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with Use...Show more In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195111725Show less
CVE-2021-0933 1Google 1Android Jun 17, 2026 Dec 15, 2021 N/A· v4 8.0 HIGH· v3 7.9 HIGH· v2 In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation o...Show more In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-172251622Show less
CVE-2021-0928 1Google 1Android Jun 17, 2026 Dec 15, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional exe...Show more In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-188675581Show less
CVE-2021-0921 1Google 1Android Jun 17, 2026 Dec 15, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional ex...Show more In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195962697Show less
CVE-2021-4117 1Yetiforce 1Yetiforce Customer Relationship Management Jun 17, 2026 Dec 15, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 yetiforcecrm is vulnerable to Business Logic Errors
CVE-2021-20330 1Mongodb 1Mongodb Jun 17, 2026 Dec 15, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoD...Show more An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.Show less
CVE-2021-4111 1Yetiforce 1Yetiforce Customer Relationship Management Jun 17, 2026 Dec 15, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 yetiforcecrm is vulnerable to Business Logic Errors
CVE-2021-41844 1Crocoblock 1Jetengine Jun 17, 2026 Dec 15, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.

Previous 1...252253254...687 Next