Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (12,848)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-3764 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 4.0 MEDIUM· v3 5.0 MEDIUM· v2 media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer informati...Show more media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.Show less
CVE-2016-3763 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 3.3 LOW· v3 5.0 MEDIUM· v2 net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a sche...Show more net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 27593919.Show less
CVE-2016-3760 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 7.5 HIGH· v3 5.4 MEDIUM· v2 Bluetooth in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows local users to gain privileges by establishing a pairing that remains present during a session of the primary user, aka intern...Show more Bluetooth in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows local users to gain privileges by establishing a pairing that remains present during a session of the primary user, aka internal bug 27410683.Show less
CVE-2016-3757 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 7.0 HIGH· v3 5.9 MEDIUM· v2 The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that at...Show more The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237. NOTE: print_maps is not related to the Vic Abell lsof product.Show less
CVE-2016-3756 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial o...Show more Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28556125.Show less
CVE-2016-3755 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted...Show more decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28470138.Show less
CVE-2016-3750 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 7.8 HIGH· v3 7.5 HIGH· v2 libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows...Show more libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a crafted application, aka internal bug 28395952.Show less
CVE-2016-3743 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v...Show more decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 27907656.Show less
CVE-2016-3742 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf...Show more decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165659.Show less
CVE-2016-3741 1Google 1Android May 6, 2026 Jul 11, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cra...Show more The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165661.Show less
CVE-2016-4324 3Canonical DebianLibreoffice 3Debian Linux LibreofficeUbuntu Linux May 6, 2026 Jul 8, 2016 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
CVE-2016-1444 1Cisco 2Telepresence Video Communication Server Telepresence Video Communication Server Software May 6, 2026 Jul 7, 2016 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass auth...Show more The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601.Show less
CVE-2016-1442 1Cisco 1Prime Infrastructure May 6, 2026 Jul 7, 2016 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280.
CVE-2016-6170 2Isc Redhat 2Bind Enterprise Linux May 6, 2026 Jul 6, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR se...Show more ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.Show less
CVE-2016-4465 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
CVE-2016-4438 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CVE-2016-4433 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
CVE-2016-4431 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
CVE-2016-3092 4Apache CanonicalDebian+1 more 6Commons Fileupload Debian LinuxIcewall Identity Manager+3 more May 6, 2026 Jul 4, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers...Show more The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.Show less
CVE-2016-1182 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service vi...Show more ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.Show less

Previous 1...452453454...643 Next