Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,875)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-1197 1Apache 1Juddi May 13, 2026 Oct 30, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp.
CVE-2016-3090 1Apache 1Struts May 13, 2026 Oct 30, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
CVE-2017-16227 2Debian Quagga 2Debian Linux Quagga May 13, 2026 Oct 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts cert...Show more The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.Show less
CVE-2017-15956 1Converto Video Downloader & Converter Project 1Converto Video Downloader & Converter May 13, 2026 Oct 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
CVE-2017-15951 1Linux 1Linux Kernel May 13, 2026 Oct 28, 2017 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a den...Show more The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.Show less
CVE-2015-1835 1Apache 1Cordova May 13, 2026 Oct 27, 2017 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a...Show more Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.Show less
CVE-2017-15928 1Ox Project 1Ox May 13, 2026 Oct 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a...Show more In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.Show less
CVE-2017-14182 1Fortinet 1Fortios May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' paramet...Show more A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API.Show less
CVE-2017-5121 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the...Show more Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.Show less
CVE-2017-5110 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents...Show more Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.Show less
CVE-2017-5109 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab vi...Show more Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.Show less
CVE-2017-5106 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVE-2017-5105 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVE-2017-5104 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page.
CVE-2017-5099 2Debian Google 2Chrome Debian Linux May 13, 2026 Oct 27, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.
CVE-2017-5097 2Debian Google 2Chrome Debian Linux May 13, 2026 Oct 27, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2017-5093 3Debian GoogleRedhat 5Chrome Debian LinuxEnterprise Linux Desktop+2 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed v...Show more Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.Show less
CVE-2017-5092 2Debian Google 2Chrome Debian Linux May 13, 2026 Oct 27, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVE-2017-5090 1Google 1Chrome May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar prob...Show more Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar problem 32458012.Show less
CVE-2017-5089 2Google Redhat 4Chrome Enterprise Linux DesktopEnterprise Linux Server+1 more May 13, 2026 Oct 27, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name.

Previous 1...403404405...644 Next