← Back
CWE-20

12,834 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JSON object

Loading...

CVEs (12,834)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-1997
1Hp
2Operations Orchestration
Operations Orchestration Content
May 6, 2026
Mar 22, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Co...Show more
HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.Show less
CVE-2016-0815
1Google
1Android
May 6, 2026
Mar 12, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary...Show more
The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.Show less
CVE-2016-1338
1Cisco
1Telepresence Video Communication Server Software
May 6, 2026
Mar 12, 2016
N/A· v4
6.5 MEDIUM· v3
8.0 HIGH· v2
Cisco TelePresence Video Communication Server (VCS) X8.5.1 and X8.5.2 allows remote authenticated users to cause a denial of service (VoIP outage) via a crafted SIP message, aka Bug ID CSCuu43026.
CVE-2016-2088
1Isc
1Bind
May 6, 2026
Mar 9, 2016
N/A· v4
6.8 MEDIUM· v3
4.3 MEDIUM· v2
resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than...Show more
resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.Show less
CVE-2016-2774
3Canonical
DebianIsc
3Debian Linux
DhcpUbuntu Linux
May 6, 2026
Mar 9, 2016
N/A· v4
5.9 MEDIUM· v3
7.1 HIGH· v2
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-...Show more
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.Show less
CVE-2016-1008
1Adobe
4Acrobat
Acrobat DcAcrobat Reader+1 more
May 6, 2026
Mar 9, 2016
N/A· v4
8.4 HIGH· v3
7.2 HIGH· v2
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and O...Show more
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.Show less
CVE-2016-0132
1Microsoft
1.net Framework
May 6, 2026
Mar 9, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified doc...Show more
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."Show less
CVE-2016-0121
1Microsoft
7Windows 10
Windows 7Windows 8.1+4 more
May 6, 2026
Mar 9, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote a...Show more
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."Show less
CVE-2016-0120
1Microsoft
7Windows 10
Windows 7Windows 8.1+4 more
May 6, 2026
Mar 9, 2016
N/A· v4
6.5 MEDIUM· v3
7.1 HIGH· v2
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote a...Show more
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."Show less
CVE-2016-0118
1Microsoft
1Windows 10
May 6, 2026
Mar 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."
CVE-2016-0117
1Microsoft
4Windows 10
Windows 8.1Windows Rt 8.1+1 more
May 6, 2026
Mar 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Co...Show more
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."Show less
CVE-2016-0101
1Microsoft
6Windows 10
Windows 7Windows 8.1+3 more
May 6, 2026
Mar 9, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via crafted media content,...Show more
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."Show less
CVE-2016-0100
1Microsoft
2Windows Server 2008
Windows Vista
May 6, 2026
Mar 9, 2016
N/A· v4
8.4 HIGH· v3
7.2 HIGH· v2
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability....Show more
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."Show less
CVE-2016-0098
1Microsoft
6Windows 10
Windows 7Windows 8.1+3 more
May 6, 2026
Mar 9, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows M...Show more
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."Show less
CVE-2016-0092
1Microsoft
7Windows 10
Windows 7Windows 8.1+4 more
May 6, 2026
Mar 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitra...Show more
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0091.Show less
CVE-2016-0091
1Microsoft
7Windows 10
Windows 7Windows 8.1+4 more
May 6, 2026
Mar 9, 2016
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitra...Show more
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0092.Show less
CVE-2016-2844
1Google
1Chrome
May 6, 2026
Mar 6, 2016
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
WebKit/Source/core/layout/LayoutBlock.cpp in Blink, as used in Google Chrome before 49.0.2623.75, does not properly determine when anonymous block wrappers may exist, which allows remote attackers to cause a denial of se...Show more
WebKit/Source/core/layout/LayoutBlock.cpp in Blink, as used in Google Chrome before 49.0.2623.75, does not properly determine when anonymous block wrappers may exist, which allows remote attackers to cause a denial of service (incorrect cast and assertion failure) or possibly have unspecified other impact via crafted JavaScript code.Show less
CVE-2016-1359
1Cisco
1Prime Infrastructure
May 6, 2026
Mar 3, 2016
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file, aka Bug ID CSCuw81494.
CVE-2016-1288
1Cisco
1Web Security Appliance
May 6, 2026
Mar 3, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intra...Show more
The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intranet connectivity and sending a malformed HTTPS request, aka Bug ID CSCuu24840.Show less
CVE-2015-6260
1Zyxel
1Gs1900 10hp Firmware
May 6, 2026
Mar 3, 2016
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, a...Show more
Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.Show less