Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,849)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-6426 1Cisco 2Unified Contact Center Express Unified Intelligence Center May 6, 2026 Oct 5, 2016 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accou...Show more The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653.Show less
CVE-2016-6380 1Cisco 6Ios Ios XeIos Xe 3.2ja+3 more May 6, 2026 Oct 5, 2016 N/A· v4 8.1 HIGH· v3 8.3 HIGH· v2 The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption...Show more The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID CSCup90532.Show less
CVE-2016-6379 1Cisco 2Ios Ios Xe May 6, 2026 Oct 5, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Detail Record (IPDR) packets, aka Bug ID CSCuu35089.
CVE-2016-6384 1Cisco 2Ios Ios Xe May 6, 2026 Oct 5, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257.
CVE-2016-7907 1Qemu 1Qemu May 6, 2026 Oct 5, 2016 N/A· v4 4.4 MEDIUM· v3 2.1 LOW· v2 The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of s...Show more The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.Show less
CVE-2016-6646 2Dell Emc 3Emc Unisphere Solutions EnablerUnisphere May 6, 2026 Oct 5, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input...Show more The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the (1) GetSymmCmdRequest or (2) RemoteServiceHandler class.Show less
CVE-2016-6645 2Dell Emc 3Emc Unisphere Solutions EnablerUnisphere May 6, 2026 Oct 5, 2016 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via craf...Show more The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via crafted input to the (1) GeneralCmdRequest, (2) PersistantDataRequest, or (3) GetCommandExecRequest class.Show less
CVE-2016-0913 1Emc 2Networker Module For Microsoft Applications Replication Manager May 6, 2026 Oct 5, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before 8.2.3.6 allows remote RM servers to execute arbitrary co...Show more The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.Show less
CVE-2016-8278 1Huawei 3Usg9520 Usg9560Usg9580 May 6, 2026 Oct 3, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service (device restart) via an unspecified URL.
CVE-2016-8277 1Huawei 3Usg9520 Usg9560Usg9580 May 6, 2026 Oct 3, 2016 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified command parameter.
CVE-2016-1244 2Debian Unadf Project 2Debian Linux Unadf May 6, 2026 Oct 3, 2016 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.
CVE-2016-1240 1Apache 1Tomcat May 6, 2026 Oct 3, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS,...Show more The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.Show less
CVE-2016-2776 3Hp IscOracle 5Bind Hp UxLinux+2 more May 6, 2026 Sep 28, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure a...Show more buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.Show less
CVE-2016-6305 1Openssl 1Openssl May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
CVE-2016-6901 1Huawei 2Ar Firmware Netengine 16ex Firmware May 6, 2026 Sep 26, 2016 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V2...Show more Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause a denial of service via format string specifiers in vectors involving partial commands.Show less
CVE-2016-6153 3Fedoraproject OpensuseSqlite 3Fedora LeapSqlite May 6, 2026 Sep 26, 2016 N/A· v4 5.9 MEDIUM· v3 4.6 MEDIUM· v2 os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unsp...Show more os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.Show less
CVE-2016-4972 1Openstack 4Mitaka Murano MuranoMurano Dashboard+1 more May 6, 2026 Sep 26, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka)...Show more OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.Show less
CVE-2016-7162 2Canonical File Roller Project 2File Roller Ubuntu Linux May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
CVE-2016-3110 2Fedoraproject Redhat 3Fedora Jboss Enterprise Application PlatformJboss Enterprise Web Server May 6, 2026 Sep 26, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate el...Show more mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.Show less
CVE-2016-5947 1Ibm 2Spectrum Control Tivoli Storage Productivity Center May 6, 2026 Sep 26, 2016 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.

Previous 1...446447448...643 Next