← Back
CWE-20

12,891 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,891)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Google
1Android
Nov 21, 2024
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
A denial of service vulnerability in the Android system (system ui). Product: Android. Versions: 8.0. Android ID: A-66498711.
1Google
1Android
Nov 21, 2024
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 6.0, 6.0.1. Android ID: A-71567394.
1Google
1Android
Nov 21, 2024
Apr 4, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
A denial of service vulnerability in the Android framework (package installer). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-62537081.
1Google
1Android
Nov 21, 2024
Apr 4, 2018
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, wit...Show more
In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71714464.Show less
1Google
1Android
Nov 21, 2024
Apr 4, 2018
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. This could lead to remote escalation of privilege with no additional execution privil...Show more
In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70808273.Show less
2Debian
Wireshark
2Debian Linux
Wireshark
Jun 17, 2026
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesting to restrict the recursion depth.
2Debian
Wireshark
2Debian Linux
Wireshark
Jun 17, 2026
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.
2Debian
Wireshark
2Debian Linux
Wireshark
Jun 17, 2026
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursion depth.
2Debian
Wireshark
2Debian Linux
Wireshark
Jun 17, 2026
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.
2Debian
Wireshark
2Debian Linux
Wireshark
Jun 17, 2026
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.
1Brave
1Brave Browser
Nov 21, 2024
Apr 4, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
3Canonical
DebianRuby Lang
3Debian Linux
RubyUbuntu Linux
Jun 17, 2026
Apr 3, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an uninte...Show more
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.Show less
1Unisys
1Stealth Svg
Jun 17, 2026
Apr 3, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash)...Show more
The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash) via crafted packets.Show less
1Google
1Android
Nov 21, 2024
Apr 3, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in MMCP, a downlink message is not being properly validat...Show more
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in MMCP, a downlink message is not being properly validated.Show less
2Fedoraproject
Redhat
2Etcd
Fedora
Nov 21, 2024
Apr 3, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
1F5
1Big Ip Application Security Manager
Nov 21, 2024
Apr 3, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
F5 BIG-IP ASM version 12.1.0 - 12.1.1 may allow remote attackers to cause a denial of service (DoS) via a crafted HTTP request.
1Apple
1Mac Os X
Nov 21, 2024
Apr 3, 2018
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Disk Images" component. It allows attackers to trigger an app launch upon mounting a crafted disk image.
1Apple
1Mac Os X
Nov 21, 2024
Apr 3, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "LaunchServices" component. It allows attackers to bypass the code-signing protection mechanism via a crafted ap...Show more
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "LaunchServices" component. It allows attackers to bypass the code-signing protection mechanism via a crafted app.Show less
1Apple
1Iphone Os
Nov 21, 2024
Apr 3, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "SafariViewController" component. It allows remote attackers to spoof the user interface via a crafted web site that...Show more
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "SafariViewController" component. It allows remote attackers to spoof the user interface via a crafted web site that leverages input into a partially loaded page.Show less
1Apple
4Iphone Os
Mac Os XTvos+1 more
Nov 21, 2024
Apr 3, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "CoreText" component....Show more
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (application crash) via a crafted string.Show less