← Back
CWE-20

12,849 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,849)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-6445
1Cisco
1Meeting Server
May 6, 2026
Oct 27, 2016
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote...Show more
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.Show less
CVE-2016-6440
1Cisco
1Unified Communications Manager
May 6, 2026
Oct 27, 2016
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz646...Show more
The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information: CSCuz64683 CSCuz64698. Known Affected Releases: 11.0(1.10000.10), 11.5(1.10000.6), 11.5(0.99838.4). Known Fixed Releases: 11.0(1.22048.1), 11.5(0.98000.1070), 11.5(0.98000.284)11.5(0.98000.346), 11.5(0.98000.768), 11.5(1.10000.3), 11.5(1.10000.6), 11.5(2.10000.2).Show less
CVE-2016-6431
1Cisco
1Adaptive Security Appliance Software
May 6, 2026
Oct 27, 2016
N/A· v4
7.5 HIGH· v3
7.1 HIGH· v2
A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to...Show more
A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker could exploit this vulnerability by sending a crafted enrollment request to the affected system. An exploit could allow the attacker to cause the reload of the affected system. Note: Only HTTPS packets directed to the Cisco ASA interface, where the local CA is allowing user enrollment, can be used to trigger this vulnerability. This vulnerability affects systems configured in routed firewall mode and in single or multiple context mode.Show less
CVE-2016-2848
1Isc
1Bind
May 6, 2026
Oct 21, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.
CVE-2015-3288
1Linux
1Linux Kernel
May 6, 2026
Oct 16, 2016
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page ze...Show more
mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.Show less
CVE-2016-7182
1Microsoft
12Live Meeting
LyncOffice+9 more
May 6, 2026
Oct 14, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Of...Show more
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows attackers to execute arbitrary code via a crafted True Type font, aka "True Type Font Parsing Elevation of Privilege Vulnerability."Show less
CVE-2016-7796
3Novell
RedhatSystemd Project
9Enterprise Linux Desktop
Enterprise Linux Hpc NodeEnterprise Linux Server+6 more
May 6, 2026
Oct 13, 2016
N/A· v4
5.5 MEDIUM· v3
4.9 MEDIUM· v2
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notif...Show more
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.Show less
CVE-2016-7795
2Canonical
Systemd Project
2Systemd
Ubuntu Linux
May 6, 2026
Oct 13, 2016
N/A· v4
5.5 MEDIUM· v3
4.9 MEDIUM· v2
The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.
CVE-2016-8563
1Siemens
1Automation License Manager
May 6, 2026
Oct 13, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to cause a denial of service (ALM service outage) via crafted packets to TCP port 4410.
CVE-2016-6696
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for...Show more
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for the data length, aka Qualcomm internal bug CR 1041130.Show less
CVE-2016-6694
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via crafted parameter data, aka...Show more
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via crafted parameter data, aka Qualcomm internal bug CR 1033525.Show less
CVE-2016-6693
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length, aka...Show more
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length, aka Qualcomm internal bug CR 1027585.Show less
CVE-2016-6674
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
system_server in Android before 2016-10-05 on Nexus devices allows attackers to gain privileges via a crafted application, aka internal bug 30445380.
CVE-2016-3937
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30030994 and MediaTek internal bug ALPS02834874.
CVE-2016-3936
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019037 and MediaTek internal bug ALPS02829568.
CVE-2016-3920
1Google
1Android
May 6, 2026
Oct 10, 2016
N/A· v4
5.5 MEDIUM· v3
7.1 HIGH· v2
id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (device hang or reboot...Show more
id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 30744884.Show less
CVE-2015-1000002
1Filedownload Project
1Filedownload
May 6, 2026
Oct 6, 2016
N/A· v4
8.2 HIGH· v3
5.8 MEDIUM· v2
Open Proxy in filedownload v1.4 wordpress plugin
CVE-2016-6433
1Cisco
1Secure Firewall Management Center
May 6, 2026
Oct 6, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
CVE-2016-6422
1Cisco
1Ios
May 6, 2026
Oct 6, 2016
N/A· v4
7.5 HIGH· v3
4.3 MEDIUM· v2
Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restr...Show more
Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restrictions by sending packets that should have been recognized by a filter, aka Bug ID CSCuy64806.Show less
CVE-2016-1454
1Cisco
1Nx Os
May 6, 2026
Oct 6, 2016
N/A· v4
6.5 MEDIUM· v3
7.1 HIGH· v2
Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device reload) by leveraging a peer...Show more
Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device reload) by leveraging a peer relationship to send a crafted BGP UPDATE message, aka Bug IDs CSCuq77105 and CSCux11417.Show less