Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,782)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-9023 1Broadcom 1Privileged Access Manager Jun 17, 2026 Jun 18, 2018 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the update_crld script.
CVE-2015-4664 2Broadcom Xceedium 2Privileged Access Manager Xsuite Nov 21, 2024 Jun 18, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
CVE-2018-1060 5Canonical DebianFedoraproject+2 more 8Ansible Tower Debian LinuxEnterprise Linux Desktop+5 more Oct 8, 2026 Jun 18, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
CVE-2018-5753 1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Jun 16, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode...Show more The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.Show less
CVE-2018-11222 1Artica 1Pandora Fms Nov 21, 2024 Jun 16, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
CVE-2018-12492 1Phpok 1Phpok Nov 21, 2024 Jun 15, 2018 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.
CVE-2018-12459 1Ffmpeg 1Ffmpeg Nov 21, 2024 Jun 15, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to...Show more An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.Show less
CVE-2018-12458 2Debian Ffmpeg 2Debian Linux Ffmpeg Nov 21, 2024 Jun 15, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of...Show more An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.Show less
CVE-2018-11574 2Canonical Point To Point Protocol Project 2Point To Point Protocol Ubuntu Linux Dec 3, 2025 Jun 14, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patc...Show more Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.Show less
CVE-2017-12070 1Opcfoundation 1Ua .net Legacy Nov 21, 2024 Jun 14, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.
CVE-2018-4833 1Siemens 9Rfid 181 Eip Firmware Ruggedcom Wimax FirmwareScalance X200 Firmware+6 more Nov 21, 2024 Jun 14, 2018 N/A· v4 8.8 HIGH· v3 5.8 MEDIUM· v2 A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch fa...Show more A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.6), SCALANCE X-300 switch family (incl. SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X408 (All versions < V4.1.3), SCALANCE X414 (All versions), SIMATIC RF182C (All versions). Unprivileged remote attackers located in the same local network segment (OSI Layer 2) could gain remote code execution on the affected products by sending a specially crafted DHCP response to a client's DHCP request.Show less
CVE-2017-17173 1Huawei 1Mate 9 Pro Fimware Nov 21, 2024 Jun 14, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free vulnerability. An attacker can tricks a user into in...Show more Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free vulnerability. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to driver to release special kernel memory resource. Successful exploit may result in phone crash or arbitrary code execution.Show less
CVE-2018-8244 1Microsoft 3Office OutlookOutlook Rt Jun 17, 2026 Jun 14, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft...Show more An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.Show less
CVE-2018-8218 1Microsoft 2Windows 10 Windows Server 2016 Jun 17, 2026 Jun 14, 2018 N/A· v4 7.7 HIGH· v3 6.8 MEDIUM· v2 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service...Show more A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers.Show less
CVE-2018-5488 1Netapp 2Santricity Storage Manager Santricity Web Services Proxy Jun 17, 2026 Jun 13, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation...Show more NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.Show less
CVE-2018-10363 1Wpdevart 1Booking Calendar Nov 21, 2024 Jun 13, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
CVE-2017-17443 1Opcfoundation 1Local Discovery Server Nov 21, 2024 Jun 13, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulner...Show more OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the configuration file is stored; however, if the configuration file is altered the LDS will be unavailable until it is repaired.Show less
CVE-2018-7162 1Nodejs 1Node.js Oct 8, 2026 Jun 13, 2018 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This c...Show more All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.Show less
CVE-2018-7161 1Nodejs 1Node.js Oct 8, 2026 Jun 13, 2018 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by...Show more All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.Show less
CVE-2018-3582 1Google 1Android Nov 21, 2024 Jun 12, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Previous 1...401402403...690 Next