Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CVEs (13,740)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-5209 1Apache 1Struts May 13, 2026 Aug 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
CVE-2017-10952 1Foxitsoftware 1Foxit Reader May 13, 2026 Aug 29, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interaction is required to exploit this vulnerability in that the target must visit a mali...Show more This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs JavaScript function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4518.Show less
CVE-2017-13735 1Libraw 1Libraw May 13, 2026 Aug 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.
CVE-2017-13685 1Sqlite 1Sqlite May 13, 2026 Aug 29, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.
CVE-2017-2254 1Cybozu 1Garoon May 13, 2026 Aug 29, 2017 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input
CVE-2015-0234 1Pki Core Project 1Pki Core May 13, 2026 Aug 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Multiple temporary file creation vulnerabilities in pki-core 10.2.0.
CVE-2015-1554 1Kgb Bot Project 1Kgb Bot May 13, 2026 Aug 28, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
CVE-2015-1443 1Fli4l 1Fli4l May 13, 2026 Aug 28, 2017 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
CVE-2017-13709 1Flightgear 1Flightgear May 13, 2026 Aug 27, 2017 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.
CVE-2017-12595 1Qpdf Project 1Qpdf May 13, 2026 Aug 27, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other im...Show more The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.Show less
CVE-2017-13692 1Htacg 1Tidy May 13, 2026 Aug 25, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNUM argument.
CVE-2015-5146 3Debian FedoraprojectNtp 3Debian Linux FedoraNtp May 13, 2026 Aug 24, 2017 N/A· v4 5.3 MEDIUM· v3 3.5 LOW· v2 ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a de...Show more ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.Show less
CVE-2017-13147 1Graphicsmagick 1Graphicsmagick May 13, 2026 Aug 23, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.
CVE-2017-13145 3Canonical DebianImagemagick 3Debian Linux ImagemagickUbuntu Linux May 13, 2026 Aug 23, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
CVE-2017-13144 1Imagemagick 1Imagemagick May 13, 2026 Aug 23, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
CVE-2017-12843 2Cyrusimap Fedoraproject 2Cyrus Imap Fedora May 13, 2026 Aug 22, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command.
CVE-2017-13061 1Imagemagick 1Imagemagick May 13, 2026 Aug 22, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafte...Show more In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.Show less
CVE-2017-12784 1Ccfile 1Cc File Transfer May 13, 2026 Aug 21, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malf...Show more In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malformed request header with many '\|' characters. NOTE: some sources use this ID for a NoviWare issue, but the correct ID for that issue is CVE-2017-12787.Show less
CVE-2017-12976 1Git Annex Project 1Git Annex May 13, 2026 Aug 20, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-201...Show more git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.Show less
CVE-2017-12961 1Gnu 1Pspp May 13, 2026 Aug 18, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

Previous 1...455456457...687 Next