Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-6571 4Debian FedoraprojectGoogle+1 more 5Backports Sle ChromeDebian Linux+2 more Jun 17, 2026 Sep 21, 2020 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVE-2020-6567 4Debian FedoraprojectGoogle+1 more 5Backports Sle ChromeDebian Linux+2 more Jun 17, 2026 Sep 21, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVE-2020-15964 4Debian FedoraprojectGoogle+1 more 5Backports Sle ChromeDebian Linux+2 more Jun 17, 2026 Sep 21, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-25787 1Tt Rss 1Tiny Tiny Rss Jun 17, 2026 Sep 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.
CVE-2020-15181 1Alfresco 1Reset Password Jun 17, 2026 Sep 18, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where...Show more The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0Show less
CVE-2020-0325 1Google 1Android Jun 17, 2026 Sep 18, 2020 N/A· v4 4.4 MEDIUM· v3 2.1 LOW· v2 In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Androi...Show more In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145079309Show less
CVE-2020-15186 1Helm 1Helm Jun 17, 2026 Sep 17, 2020 N/A· v4 2.7 LOW· v3 4.0 MEDIUM· v2 In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicatin...Show more In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.Show less
CVE-2020-15184 1Helm 1Helm Jun 17, 2026 Sep 17, 2020 N/A· v4 2.7 LOW· v3 4.0 MEDIUM· v2 In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been...Show more In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.Show less
CVE-2020-0363 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libmedia, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitati...Show more In libmedia, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-132274514Show less
CVE-2020-0362 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for expl...Show more In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123237930Show less
CVE-2020-0353 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploi...Show more In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124777526Show less
CVE-2020-0351 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 7.1 HIGH· v2 In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitatio...Show more In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124777537Show less
CVE-2020-0333 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Andro...Show more In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755Show less
CVE-2020-0320 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for expl...Show more In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129282427Show less
CVE-2020-0301 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for expl...Show more In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124940460Show less
CVE-2020-0287 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploi...Show more In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141860394Show less
CVE-2020-0130 1Google 1Android Jun 17, 2026 Sep 17, 2020 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with User execution privileges needed. User interaction is not ne...Show more In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123230379Show less
CVE-2020-14338 1Redhat 1Xerces Jun 17, 2026 Sep 17, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-cra...Show more A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.Show less
CVE-2020-24377 1Free 5Freebox Delta Firmware Freebox Mini FirmwareFreebox One Firmware+2 more Jun 17, 2026 Sep 16, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3.
CVE-2020-24376 1Free 5Freebox Delta Firmware Freebox Mini FirmwareFreebox One Firmware+2 more Jun 17, 2026 Sep 16, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3.

Previous 1...298299300...687 Next